CVE-2026-71020: Oracle Commerce Auth Bypass Vulnerability

CVE-2026-71020 Overview

CVE-2026-71020 is an access control weakness [CWE-284] in the Endeca Application Controller component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager. The flaw affects version 11.4.0. A low-privileged attacker with network access over HTTP can exploit the vulnerability, but successful attacks require interaction from a user other than the attacker. Exploitation results in a scope change, meaning the compromise can affect resources beyond the vulnerable component. Successful attacks yield unauthorized read access to all data accessible to the product and unauthorized modification of a subset of that data.

Critical Impact
Attackers can gain complete read access to product data and modify a subset of records, with the scope-change condition extending impact to adjacent Oracle Commerce components.

Affected Products

Oracle Commerce Guided Search 11.4.0
Oracle Commerce Experience Manager 11.4.0
Endeca Application Controller component

Discovery Timeline

2026-08-18 - CVE-2026-71020 published to NVD
2026-08-18 - Oracle publishes Security Alert August 2026
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71020

Vulnerability Analysis

The vulnerability resides in the Endeca Application Controller, the component responsible for orchestrating Endeca Information Discovery applications within Oracle Commerce Guided Search and Experience Manager. Improper access control [CWE-284] allows a low-privileged authenticated user to reach functionality that should be restricted. Because the vulnerable code path triggers a scope change, exploitation impacts security boundaries outside the vulnerable component itself.

Exploitation requires human interaction from a user other than the attacker, which is consistent with delivery vectors such as crafted links or requests that a legitimate administrator or operator activates. The confidentiality impact is high while the integrity impact is limited, and availability is unaffected.

Root Cause

The root cause is missing or insufficient enforcement of access control checks within the Endeca Application Controller. Requests originating from low-privilege accounts are not properly filtered against the privileges required to view or alter protected data, allowing lateral access to information and limited modification capabilities across the product surface.

Attack Vector

The attack proceeds over the network using HTTP. An authenticated attacker with basic access sends a crafted request to an Endeca Application Controller endpoint. The attacker must induce another user to complete an action to trigger the vulnerable flow. Once triggered, the request executes with expanded reach, exposing accessible data and permitting selective writes. See the Oracle Security Alert August 2026 for vendor technical details.

Detection Methods for CVE-2026-71020

Indicators of Compromise

Unexpected HTTP requests to Endeca Application Controller endpoints originating from low-privileged user sessions.
Anomalous read or export operations against Endeca application data that do not match established user role patterns.
Modification events on Endeca application configuration or content records tied to accounts without administrative roles.

Detection Strategies

Correlate authenticated session activity with the role of the requesting account and alert on privilege-role mismatches at the Endeca Application Controller.
Baseline typical request patterns for Guided Search and Experience Manager administrators and flag deviations that follow user-interaction events such as link clicks.
Inspect web server and application logs for HTTP requests targeting administrative Endeca endpoints from unusual source addresses.

Monitoring Recommendations

Forward Oracle Commerce and Endeca application logs to a centralized analytics platform for role-aware analysis.
Monitor for outbound data volume spikes from Endeca hosts that may indicate mass data extraction.
Track create, update, and delete events on Endeca content assets and alert on changes made outside normal change windows.

How to Mitigate CVE-2026-71020

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert August 2026 to all Oracle Commerce Guided Search and Experience Manager 11.4.0 deployments.
Review and restrict accounts that hold low-privilege access to the Endeca Application Controller until patching completes.
Audit recent access and modification events in Endeca application data for signs of exploitation.

Patch Information

Oracle addressed CVE-2026-71020 in the August 2026 Security Alert. Administrators should download and apply the vendor-provided patch for Oracle Commerce Guided Search / Experience Manager 11.4.0 as directed in the advisory. No supported workaround replaces the patch.

Workarounds

Limit network exposure of the Endeca Application Controller to trusted administrative networks using firewall or reverse proxy rules.
Enforce phishing-resistant authentication and user awareness training to reduce the likelihood of the required user interaction step succeeding.
Disable or restrict low-privilege accounts that do not require access to the Endeca Application Controller.

bash

# Configuration example: restrict Endeca Application Controller access via firewall
# Replace 10.0.0.0/24 with your administrative subnet
iptables -A INPUT -p tcp --dport 8006 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8006 -j DROP