CVE-2026-71020

Oracle Commerce 11.4.0's Endeca Application Controller allows a low-privileged network attacker to compromise Guided Search and Experience Manager via HTTP. CVSS 7.6 (HIGH) enables unauthorized data access and limited modification; human interaction is required. Oracle's August 2026 CPU advisory ...