CVE-2026-71028: Oracle Commerce Privilege Escalation Flaw

CVE-2026-71028 Overview

CVE-2026-71028 affects the Endeca Application Controller component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager version 11.4.0. The flaw allows a low-privileged attacker with local logon access to the infrastructure hosting the product to fully compromise the deployment. Oracle disclosed the issue in the Oracle Security Alert August 2026. The vulnerability maps to [CWE-284] Improper Access Control and impacts confidentiality, integrity, and availability.

Critical Impact
Successful exploitation results in complete takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, exposing search configurations, catalog data, and commerce experience workflows.

Affected Products

Oracle Commerce Guided Search 11.4.0
Oracle Commerce Experience Manager 11.4.0
Endeca Application Controller component

Discovery Timeline

2026-08-18 - CVE-2026-71028 published to NVD
2026-08-18 - Oracle publishes Security Alert August 2026
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71028

Vulnerability Analysis

The vulnerability resides in the Endeca Application Controller (EAC), the orchestration component responsible for managing Endeca application lifecycles, index provisioning, and administrative tasks in Oracle Commerce Guided Search and Experience Manager 11.4.0. Improper access control on privileged operations lets an authenticated local user perform actions reserved for administrators. An attacker who successfully exploits the flaw can take over the Oracle Commerce Guided Search / Experience Manager instance and manipulate merchandising rules, dynamic business logic, and search behavior.

Root Cause

The root cause is classified as [CWE-284] Improper Access Control. The Endeca Application Controller does not sufficiently restrict privileged operations to authorized principals. Any user with local logon rights on the host can invoke administrative functions that should be gated by stronger authorization checks.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. The attacker must already possess a valid account on the infrastructure where the Endeca Application Controller runs. Once authenticated, the attacker interacts with the controller's exposed administrative interfaces to abuse the missing access control checks. Because the scope is unchanged and impact is high across confidentiality, integrity, and availability, the attacker ultimately obtains full control of the commerce search platform.

No public proof-of-concept code is available for CVE-2026-71028. Refer to the Oracle Security Alert August 2026 for vendor-specific technical guidance.

Detection Methods for CVE-2026-71028

Indicators of Compromise

Unexpected administrative actions in Endeca Application Controller logs originating from non-administrative local accounts.
Unauthorized modifications to Endeca application definitions, index configurations, or eaccmd scripts.
New or altered scheduled tasks under the EAC configuration directory that were not deployed by change management.
Unusual invocation of EAC command-line utilities outside of maintenance windows.

Detection Strategies

Baseline expected EAC administrative activity and alert on deviations by user, time, and command.
Monitor process execution on Endeca hosts for unexpected child processes spawned from EAC service accounts.
Correlate local logon events on Endeca infrastructure with subsequent EAC administrative calls to identify low-privileged users escalating scope.

Monitoring Recommendations

Forward EAC application logs, Windows or Linux authentication logs, and host process telemetry into a centralized SIEM for correlation.
Enable file integrity monitoring on the EAC configuration directory and Endeca application XML definitions.
Alert on privilege changes, new local accounts, and lateral movement toward Endeca hosts.

How to Mitigate CVE-2026-71028

Immediate Actions Required

Apply the fixes published in the Oracle Security Alert August 2026 to all Oracle Commerce Guided Search and Experience Manager 11.4.0 deployments.
Inventory all hosts running the Endeca Application Controller and confirm patch coverage.
Audit local accounts on Endeca infrastructure and remove unnecessary logon rights.
Rotate credentials for service and administrative accounts associated with EAC after patching.

Patch Information

Oracle addressed CVE-2026-71028 in the Security Alert issued on 2026-08-18. Administrators should follow the patching instructions in the advisory for the affected 11.4.0 release. Review the Oracle Security Alert August 2026 for the exact patch package and installation prerequisites.

Workarounds

Restrict local logon on Endeca hosts to a minimal set of vetted administrators until patches are applied.
Segment Endeca infrastructure on isolated management networks and require jump-host access.
Enforce multi-factor authentication on any account that can reach the Endeca Application Controller host.
Increase logging verbosity on the EAC component to capture privileged operations for post-incident review.

bash

# Example: restrict interactive logon on a Linux Endeca host to the endeca-admins group
sudo groupadd endeca-admins
sudo usermod -aG endeca-admins <administrator-account>

# /etc/security/access.conf
# Deny interactive logon to all users except the endeca-admins group and root
+ : root : ALL
+ : (endeca-admins) : ALL
- : ALL : ALL

# Enable pam_access in /etc/pam.d/login and /etc/pam.d/sshd
# account    required     pam_access.so