CVE-2026-70996 Overview
CVE-2026-70996 affects the Endeca Application Controller component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager, version 11.4.0. An unauthenticated attacker with network access over HTTP can exploit the flaw without user interaction. Successful exploitation results in unauthorized access to critical data or complete access to all data accessible through the affected products.
The vulnerability carries a scope change, meaning attacks originating in Oracle Commerce Guided Search may significantly impact additional products. The weakness is classified under CWE-284: Improper Access Control.
Critical Impact
Unauthenticated remote attackers can obtain complete read access to data across the affected Oracle Commerce deployment, with impact extending beyond the vulnerable component due to scope change.
Affected Products
- Oracle Commerce Guided Search 11.4.0
- Oracle Commerce Experience Manager 11.4.0
- Endeca Application Controller (component of the above products)
Discovery Timeline
- 2026-08-18 - CVE-2026-70996 published to NVD
- 2026-08-20 - Last updated in NVD database
- August 2026 - Addressed in the Oracle Security Alert August 2026
Technical Details for CVE-2026-70996
Vulnerability Analysis
The flaw resides in the Endeca Application Controller (EAC), the management service that orchestrates Endeca application deployment, indexing, and operational control within Oracle Commerce Guided Search and Experience Manager. The EAC exposes HTTP-accessible endpoints that fail to enforce proper access control, allowing unauthenticated clients to interact with restricted functionality.
Because the vulnerability enables a scope change, an attacker leveraging the EAC can pivot to affect resources managed by other components in the Oracle Commerce stack. The Confidentiality impact is rated High, while Integrity and Availability are not affected, indicating the primary risk is data exposure rather than modification or disruption.
Root Cause
The root cause is improper access control [CWE-284] in the Endeca Application Controller. Authorization checks on HTTP-exposed operations are missing or inadequate, allowing anonymous callers to invoke functions that should require authenticated administrative privileges. Refer to the Oracle Security Alert August 2026 for vendor-provided technical details.
Attack Vector
Exploitation requires only network reachability to the EAC HTTP interface. No credentials, user interaction, or elevated privileges are needed. An attacker sends crafted HTTP requests directly to the exposed EAC endpoints to retrieve application data, configuration, or index content. Deployments that expose EAC beyond trusted management networks face the highest risk.
No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.303% (percentile 22.978) as of 2026-08-20.
Detection Methods for CVE-2026-70996
Indicators of Compromise
- Unauthenticated HTTP requests to Endeca Application Controller endpoints (default port 8888 and related EAC ports) originating from unexpected source addresses.
- Outbound data transfers of unusual size from Oracle Commerce servers following inbound EAC HTTP traffic.
- EAC access logs showing successful operations with no preceding authentication events.
Detection Strategies
- Baseline legitimate EAC administrative clients and alert on HTTP requests from any source outside that allowlist.
- Inspect web server and reverse proxy logs for requests to EAC control paths that return 200 OK without corresponding session or authentication tokens.
- Correlate network flow data with EAC service logs to identify anonymous data enumeration patterns.
Monitoring Recommendations
- Forward EAC, application server, and reverse proxy logs to a centralized SIEM for retention and correlation.
- Monitor for spikes in HTTP traffic volume to Oracle Commerce management interfaces.
- Alert on any EAC access from source IPs that are not part of the documented administrative subnet.
How to Mitigate CVE-2026-70996
Immediate Actions Required
- Apply the fix from the Oracle Security Alert August 2026 to all Oracle Commerce Guided Search and Experience Manager 11.4.0 deployments.
- Restrict network access to the Endeca Application Controller so only trusted management hosts can reach its HTTP interface.
- Review EAC access logs for anomalous unauthenticated requests since the service was deployed.
Patch Information
Oracle addressed CVE-2026-70996 in the August 2026 Critical Patch Update / Security Alert cycle. Administrators should download and apply the patch referenced in the Oracle Security Alert August 2026 and follow Oracle's documented upgrade procedure for Oracle Commerce 11.4.0.
Workarounds
- Place the EAC service behind a firewall or reverse proxy that enforces IP allowlisting for administrative subnets only.
- Terminate direct internet exposure of the EAC HTTP endpoints and require VPN or jump-host access.
- Enforce network segmentation between Oracle Commerce management components and internet-facing storefront tiers until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
