CVE-2026-71015 Overview
CVE-2026-71015 is a missing authentication vulnerability [CWE-306] in the Endeca Application Controller component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager. The affected version is 11.4.0. An unauthenticated attacker with network access via HTTP can compromise the application without user interaction. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, and unauthorized read access to all data accessible by the product.
Critical Impact
Unauthenticated network attackers can read and modify all data accessible to Oracle Commerce Guided Search / Experience Manager 11.4.0 over HTTP.
Affected Products
- Oracle Commerce Guided Search, version 11.4.0
- Oracle Commerce Experience Manager, version 11.4.0
- Endeca Application Controller component
Discovery Timeline
- 2026-08-18 - CVE-2026-71015 published to NVD
- 2026-08-22 - Last updated in NVD database
- Oracle Security Alert CSPUAUG2026 - Vendor advisory released (Oracle Security Alert CSPUAUG2026)
Technical Details for CVE-2026-71015
Vulnerability Analysis
The flaw resides in the Endeca Application Controller (EAC), the administrative service that manages Endeca application lifecycle operations, including provisioning, indexing, and deployment. The EAC exposes HTTP endpoints that fail to enforce authentication on privileged operations. An attacker who can reach the EAC service over the network can invoke controller functions without credentials.
The consequence is unauthorized read and write access to data managed by Oracle Commerce Guided Search and Experience Manager. Availability is not impacted according to the CVSS vector, but the confidentiality and integrity impacts are rated high. Because exploitation requires no privileges and no user interaction, automated scanning and mass exploitation are feasible where the EAC is reachable.
Root Cause
The root cause is Missing Authentication for a Critical Function [CWE-306]. The Endeca Application Controller accepts HTTP requests to sensitive operations without validating the caller's identity or authorization. This design assumes the EAC port is isolated on a management network, an assumption that fails when the service is exposed beyond trusted boundaries.
Attack Vector
The attack vector is remote and network-based over HTTP. An attacker sends crafted HTTP requests directly to the EAC endpoint on the affected Oracle Commerce server. No authentication token, session, or user interaction is required. Successful requests enable retrieval and modification of application data, configuration, and index content.
No public proof-of-concept exploit or in-the-wild exploitation has been reported at the time of publication. The EPSS score is 0.377%. Refer to the Oracle Security Alert CSPUAUG2026 for vendor-specific technical details.
Detection Methods for CVE-2026-71015
Indicators of Compromise
- Unauthenticated HTTP requests to the Endeca Application Controller port (default 8888) from external or non-management network segments.
- Unexpected changes to Endeca application configuration, MDEX index content, or deployment scripts without corresponding administrator activity.
- New or modified EAC scripts, provisioning actions, or component definitions appearing in EAC logs without an authenticated operator.
- Outbound connections initiated by the Endeca server to unfamiliar hosts following inbound HTTP traffic to the EAC.
Detection Strategies
- Inspect EAC access logs for HTTP requests to administrative paths originating from unexpected source addresses.
- Correlate configuration changes in EAC and MDEX with authenticated administrator sessions and change-management records.
- Alert on HTTP requests to Endeca controller ports from any host outside the documented management subnet.
Monitoring Recommendations
- Forward Endeca EAC, MDEX, and web server logs to a centralized analytics platform for retention and query.
- Baseline normal administrative traffic patterns to the EAC and alert on deviations in volume, source, or endpoint accessed.
- Monitor file integrity on Endeca application directories, index files, and deployment scripts.
How to Mitigate CVE-2026-71015
Immediate Actions Required
- Apply the patches referenced in Oracle Security Alert CSPUAUG2026 to all Oracle Commerce Guided Search and Experience Manager 11.4.0 deployments.
- Restrict network access to the Endeca Application Controller port so that only trusted management hosts can reach it.
- Review EAC and application logs for unauthorized configuration or data changes prior to patching.
- Rotate any credentials, API keys, or secrets stored within or accessible to the Endeca application.
Patch Information
Oracle addressed this vulnerability in the security alert bundle referenced as CSPUAUG2026. Administrators should download and apply the fixes documented at the Oracle Security Alert CSPUAUG2026 advisory. Verify the patch level after installation and restart Endeca services to load the updated components.
Workarounds
- Place the Endeca Application Controller behind a firewall or reverse proxy that enforces IP allow-listing to management workstations only.
- Bind the EAC service to a private management interface rather than a publicly routable address.
- Require VPN or bastion-host access to reach EAC administrative endpoints until patching is complete.
# Example: restrict EAC port 8888 to a management subnet using iptables
iptables -A INPUT -p tcp --dport 8888 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8888 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
