CVE-2026-71002

...

CVE-2026-71003

...

CVE-2026-71002

Oracle Commerce 11.4.0's Experience Manager component is vulnerable via HTTP; a low-privileged network attacker can modify or delete critical data with scope change (CVSS 8.5). No exploit code is provided. Apply Oracle's August 2026 CPU patches.

CVE-2026-70999

...

CVE-2026-70995

The Endeca Application Controller component in Oracle Commerce 11.4.0 is critically vulnerable (CVSS 9.8) to unauthenticated remote HTTP attacks, enabling full system takeover. Oracle has released patches via its August 2026 Critical Patch Update; organizations should apply them immediately. No p...

CVE-2026-70990

...

CVE-2026-70989

...

CVE-2026-70987

Oracle Commerce 11.4.0's Content Acquisition System component allows unauthenticated remote attackers via HTTP to access critical data (CVSS 7.5 HIGH, confidentiality-only). Oracle has issued updates; see https://www.oracle.com/security-alerts/cspuaug2026.html. Exploitation details are not provid...

CVE-2026-70985

Oracle Commerce 11.4.0 Content Acquisition System allows unauthenticated, network-based HTTP attacks causing high confidentiality impact (CVSS 7.5). Oracle's August 2026 CPU advisory addresses it; no exploit or root-cause details are provided in the documents.

CVE-2026-70981

Oracle Commerce 11.4.0 Content Acquisition System is affected by a critical (CVSS 9.1) unauthenticated network-based vulnerability enabling unauthorized data modification and denial of service. No exploitation details are provided; refer to Oracle's August 2026 security alert for patch information.

CVE-2026-70972

...

CVE-2026-70973

...

CVE-2026-70970

...

CVE-2026-70971

Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Installation and Configuration component) has a network-reachable vulnerability allowing a low-privileged attacker to gain unauthorized access to critical data and modify some data. CVSS 7.1 (HIGH). No exploit details provided; remediation ...

CVE-2026-70967

...

CVE-2026-70968

...

CVE-2026-70965

...

CVE-2026-70963

Oracle Hyperion Infrastructure Technology (version 11.2.25.0.000, Installation and Configuration component) is vulnerable to a network-accessible attack requiring low privileges. A successful exploit yields unauthorized read and write access to a subset of data. CVSS 4.2 (Medium) reflects high at...

CVE-2026-70960

...

CVE-2026-70960

Oracle Hyperion Financial Management 11.2.25.0.000 has a HIGH-severity (CVSS 7.6) Security component flaw exploitable over HTTP by a low-privileged attacker, enabling unauthorized data access and modification with scope change. Oracle's August 2026 CPU patch is the remediation. No in-the-wild exp...