CVE-2026-71032: Oracle Commerce Authentication Bypass Flaw

CVE-2026-71032 Overview

CVE-2026-71032 is an access control vulnerability in the Endeca Application Controller component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager. The affected release is version 11.4.0. An unauthenticated attacker with network access over HTTP can exploit the flaw without user interaction. Successful exploitation permits unauthorized read access to a subset of data and unauthorized create, update, or delete operations on other data. The scope is marked as changed, indicating impact can extend to components beyond the vulnerable product. Oracle addressed the issue in the Oracle Security Alert August 2026.

Critical Impact
Unauthenticated network attackers can modify and read data in Oracle Commerce Guided Search / Experience Manager, with scope change extending impact to adjacent products.

Affected Products

Oracle Commerce Guided Search 11.4.0
Oracle Commerce Experience Manager 11.4.0
Endeca Application Controller (component)

Discovery Timeline

2026-08-18 - CVE-2026-71032 published to NVD
2026-08-18 - Oracle Security Alert August 2026 released with patch
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71032

Vulnerability Analysis

The vulnerability resides in the Endeca Application Controller (EAC), the administrative service that orchestrates Endeca deployment operations for Oracle Commerce Guided Search and Experience Manager. The flaw is classified under [CWE-284: Improper Access Control]. EAC accepts operations over HTTP without enforcing sufficient authentication or authorization checks. As a result, remote actors can invoke controller functions that read and modify application state.

The scope change indicator reflects that EAC coordinates activity across multiple Endeca subsystems including the MDEX Engine, Content Acquisition System, and Workbench. Actions performed through the controller propagate to those downstream components. Data integrity and confidentiality are both impacted, while availability is not directly affected according to the published CVSS vector.

Root Cause

The root cause is missing or insufficient access control on network-exposed EAC endpoints. The Endeca Application Controller was originally designed for use inside trusted management networks and relies on network segmentation rather than authenticated APIs. When the service is reachable over HTTP without additional controls, unauthenticated callers can invoke privileged operations.

Attack Vector

An attacker sends crafted HTTP requests to the Endeca Application Controller service. No credentials, no prior foothold, and no user interaction are required. Successful requests allow the attacker to read subsets of application data and perform insert, update, or delete operations. Because EAC drives configuration and provisioning across the Endeca stack, modifications can pivot into other Oracle Commerce components. Refer to the Oracle Security Alert August 2026 for vendor-specific technical detail.

Detection Methods for CVE-2026-71032

Indicators of Compromise

Unexpected HTTP requests to Endeca Application Controller ports (default 8888, 8090) from non-management network segments.
Unauthenticated EAC operations invoking runcommand, provision, or script execution actions in EAC logs.
Unexplained changes to Endeca application definitions, scripts, or MDEX index configurations.
New or modified EAC scripts (.xml provisioning files) without a corresponding change record.

Detection Strategies

Enable and centralize EAC access logging, then alert on any request that lacks an expected source address or session context.
Baseline legitimate EAC administrative activity by user, host, and time window; flag deviations.
Correlate EAC activity with downstream MDEX and Content Acquisition System events to surface scope-change exploitation.

Monitoring Recommendations

Forward Endeca controller and web server logs to a central SIEM or data lake for retention and query.
Monitor for outbound connections initiated by EAC processes to unexpected destinations after configuration changes.
Track file integrity on Endeca application directories and provisioning scripts on the EAC host.

How to Mitigate CVE-2026-71032

Immediate Actions Required

Apply the fixes published in the Oracle Security Alert August 2026 to all Oracle Commerce Guided Search and Experience Manager 11.4.0 deployments.
Restrict network access to Endeca Application Controller ports so that only authorized administrative hosts can reach the service.
Audit EAC logs for unauthenticated or unexpected requests dating back to before the patch window.

Patch Information

Oracle released the fix as part of the August 2026 Critical Patch Update / Security Alert cycle. Administrators should download the applicable patch bundle for Oracle Commerce Guided Search / Experience Manager 11.4.0 from My Oracle Support and follow the deployment steps in the alert. Verify the EAC service restarts cleanly and confirm application definitions after patching.

Workarounds

Place the Endeca Application Controller behind a network-level access control list or firewall that limits HTTP access to trusted administrative IP ranges.
Front EAC with a reverse proxy that enforces mutual TLS or HTTP authentication until patching is complete.
Disable or shut down EAC on production nodes where interactive administrative access is not required.

bash

# Example: restrict EAC HTTP port to management subnet only (Linux iptables)
iptables -A INPUT -p tcp --dport 8888 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8888 -j DROP