CVE-2026-71038

...

CVE-2026-71035

A HIGH-severity (CVSS 8.1) vulnerability affects Oracle Commerce 11.4.0's Forge component, exploitable by an unauthenticated remote attacker over HTTP with high attack complexity, leading to full compromise of Guided Search/Experience Manager (C/I/A impact). Oracle's August 2026 CPU advisory is t...

CVE-2026-71034

Oracle Commerce 11.4.0 (component: Forge) is vulnerable to an unauthenticated SOAP-based attack via network access. Successful exploitation enables an attacker to gain unauthorized access to critical data or complete access to all accessible Oracle Commerce data, with confidentiality impact rated...

CVE-2026-71036

Oracle Commerce version 11.4.0 Experience Manager component is vulnerable to an unauthenticated, network-accessible attack (CVSS 9.1) allowing full confidentiality and integrity compromise. Oracle's August 2026 CPU advisory provides patch details; no exploitation evidence is present in the provid...

CVE-2026-71033

...

CVE-2026-71031

...

CVE-2026-71032

...

CVE-2026-71023

An unauthenticated, network-reachable flaw in Oracle Commerce 11.4.0's Endeca Application Controller allows arbitrary creation, deletion, or modification of all accessible data (CVSS 7.5, HIGH). No exploitation evidence is provided. Customers should consult Oracle's August 2026 CPU advisory for p...

CVE-2026-71021

...

CVE-2026-71018

Oracle Commerce 11.4.0's Endeca Application Controller is vulnerable: unauthenticated remote attackers can exploit it via HTTP to read all accessible data and modify some data, requiring victim interaction; CVSS 3.1 score 8.2 (High). No specific root cause or patch details are provided. No known ...

CVE-2026-71017

Oracle Commerce 11.4.0's Endeca Application Controller is vulnerable to an unauthenticated, network-accessible HTTP attack (CVSS 6.5, HIGH complexity). Successful exploitation yields unauthorized access to critical data and partial denial of service. No exploit details are provided; Oracle's Augu...

CVE-2026-71015

Oracle Commerce 11.4.0 (Endeca Application Controller) has a critical CVSS 9.1 flaw exploitable by unauthenticated attackers over HTTP, enabling unauthorized data creation, deletion, modification, and full data access; no exploit details are provided, and the Oracle CSP advisory (cspuaug2026.html...

CVE-2026-71014

...

CVE-2026-71012

A low-privilege network attacker can exploit insufficient access control in Oracle Commerce Experience Manager 11.4.0 to read critical data and cause partial DoS (CVSS 7.1). Oracle released patches in its August 2026 Critical Patch Update; no in-the-wild exploitation is reported. Apply the update...

CVE-2026-71010

...

CVE-2026-71008

Oracle Commerce Experience Manager component in version 11.4.0 is affected by a network-reachable vulnerability exploitable by a high-privileged HTTP attacker, enabling unauthorized access to critical or all accessible data (CVSS 6.8, confidentiality impact). Exploitation details are not provided...

CVE-2026-71007

...

CVE-2026-71002

...

CVE-2026-71003

...

CVE-2026-71002

Oracle Commerce 11.4.0's Experience Manager component is vulnerable via HTTP; a low-privileged network attacker can modify or delete critical data with scope change (CVSS 8.5). No exploit code is provided. Apply Oracle's August 2026 CPU patches.