CVE-2026-71035

HIGH 8.1CVE-2026-71035 · Published 18/08/2026 · updated 22/10/2026

In short

CVE-2026-71035 is a HIGH (CVSS 8.1) vulnerability affecting commerce experience manager (oracle), commerce guided search (oracle).
Chance of exploitation in the next 30 days (EPSS): 0.39%, higher than 33.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
commerce experience manager oracle	`= 11.4.0`	No fix yet
commerce guided search oracle	`= 11.4.0`	No fix yet

Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

References

oracle.com/security-alerts/cspuaug2026.html · Vendor Advisory

More vulnerabilities in commerce experience manager

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In short

CVE-2026-71035 is a HIGH (CVSS 8.1) vulnerability affecting commerce experience manager (oracle), commerce guided search (oracle).

Chance of exploitation in the next 30 days (EPSS): 0.39%, higher than 33.4% of all vulnerabilities.

No patched version is listed yet: follow the vendor's advisory in References.

Package

Affected versions

Patched versions

commerce experience manager

oracle

= 11.4.0

No fix yet

commerce guided search

oracle

= 11.4.0

No fix yet

Description

More vulnerabilities in commerce experience manager

See all →