CVE-2026-71014: Oracle Commerce Authentication Bypass

CVE-2026-71014 Overview

CVE-2026-71014 is an improper access control vulnerability [CWE-284] in the Endeca Application Controller component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager. The affected version is 11.4.0. An unauthenticated attacker with network access via HTTP can compromise the product without user interaction. Successful exploitation grants unauthorized read access and the ability to create, delete, or modify all data accessible to the application. Oracle disclosed the flaw in the August 2026 security alert cycle.

Critical Impact
Remote unauthenticated attackers can read and tamper with all data accessible to Oracle Commerce Guided Search and Experience Manager, including catalog, pricing, and merchandising content.

Affected Products

Oracle Commerce Guided Search 11.4.0
Oracle Commerce Experience Manager 11.4.0
Endeca Application Controller (component)

Discovery Timeline

2026-08-18 - CVE-2026-71014 published to the National Vulnerability Database
2026-08-18 - Oracle Security Alert August 2026 released
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-71014

Vulnerability Analysis

The vulnerability resides in the Endeca Application Controller (EAC), the administrative service that orchestrates provisioning, indexing, and application lifecycle operations for Oracle Commerce Guided Search deployments. Improper access control [CWE-284] permits an unauthenticated HTTP client to invoke controller operations that should require authentication. Attackers reach these operations directly over the network without credentials or user interaction. The attack complexity is low, and no privileges are required.

Successful exploitation exposes catalog data, merchandising rules, and configuration accessible to the application. The same access allows attackers to create, modify, or delete that data. In an e-commerce context, this can be used to alter product listings, pricing metadata, and search relevance rules.

Root Cause

The root cause is missing or insufficient authorization on network-exposed endpoints of the Endeca Application Controller. Oracle has not published a technical breakdown of the specific endpoints or checks involved. Refer to the Oracle Security Alert August 2026 for the authoritative advisory.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends crafted requests to the exposed Endeca Application Controller service. Because no authentication is required and the scope remains unchanged, exploitation is limited to systems where the controller is reachable from the attacker's network position. Deployments that expose the EAC port to untrusted networks are at the highest risk.

No verified proof-of-concept code is available for CVE-2026-71014.
See the Oracle Security Alert August 2026 for vendor guidance:
https://www.oracle.com/security-alerts/cspuaug2026.html

Detection Methods for CVE-2026-71014

Indicators of Compromise

Unauthenticated HTTP requests to Endeca Application Controller endpoints from unexpected source addresses.
Unexpected modifications to Guided Search application definitions, index configurations, or content rules.
Provisioning or baseline update jobs initiated outside of change windows or by unknown clients.

Detection Strategies

Review web and reverse-proxy logs for anonymous requests targeting EAC administrative paths.
Correlate configuration and content changes in Experience Manager with authenticated administrator sessions to identify unattributed changes.
Alert on outbound connections from Commerce Guided Search hosts that deviate from established baselines.

Monitoring Recommendations

Enable verbose access logging on the Endeca Application Controller and forward logs to a centralized platform for retention and analysis.
Monitor for anomalous administrative operations such as application creation, deletion, or script execution against EAC.
Track integrity of catalog and merchandising data by comparing snapshots against known-good baselines.

How to Mitigate CVE-2026-71014

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert August 2026 to all Oracle Commerce Guided Search and Experience Manager 11.4.0 deployments.
Restrict network access to the Endeca Application Controller so only trusted management hosts can reach it.
Audit recent administrative activity and configuration changes for signs of unauthorized modification.

Patch Information

Oracle addressed CVE-2026-71014 in the August 2026 Security Alert. Administrators should consult the Oracle Security Alert August 2026 for the specific patch bundle applicable to Oracle Commerce Guided Search and Experience Manager 11.4.0 and follow Oracle's documented upgrade procedure.

Workarounds

Place the Endeca Application Controller behind a reverse proxy or firewall that enforces IP allowlisting for management interfaces.
Segment Commerce Guided Search infrastructure from internet-facing networks and require VPN or bastion access for administration.
Disable or block any unused EAC endpoints exposed on shared network segments until the patch is applied.

bash

# Example: restrict Endeca Application Controller port (default 8888/8500)
# to a management subnet using iptables
iptables -A INPUT -p tcp --dport 8888 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8888 -j DROP