SB20261107426 - Multiple vulnerabilities in Oracle Commerce Guided Search

Description

This security bulletin contains information about 63 vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2026-70980)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

2) Improper input validation (CVE-ID: CVE-2026-71027)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to read and manipulate data.

3) Improper input validation (CVE-ID: CVE-2026-71021)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to read and manipulate data.

4) Improper input validation (CVE-ID: CVE-2026-71020)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to read and manipulate data.

5) Improper input validation (CVE-ID: CVE-2026-70988)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.

6) Improper input validation (CVE-ID: CVE-2026-71010)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A local non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

7) Improper input validation (CVE-ID: CVE-2026-71028)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A local authenticated user can exploit this vulnerability to execute arbitrary code.

8) Improper input validation (CVE-ID: CVE-2026-71035)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Forge component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

9) Improper input validation (CVE-ID: CVE-2026-70999)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to read and manipulate data.

10) Improper input validation (CVE-ID: CVE-2026-71024)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Forge component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

11) Improper input validation (CVE-ID: CVE-2026-71018)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

12) Improper input validation (CVE-ID: CVE-2026-71016)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

13) Improper input validation (CVE-ID: CVE-2026-70993)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to damange or delete data.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to damange or delete data.

14) Improper input validation (CVE-ID: CVE-2026-71002)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to read and manipulate data.

15) Improper input validation (CVE-ID: CVE-2026-70996)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

16) Improper input validation (CVE-ID: CVE-2026-71000)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to read and manipulate data.

17) Improper input validation (CVE-ID: CVE-2026-71022)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Workbench component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to read and manipulate data.

18) Improper input validation (CVE-ID: CVE-2026-71036)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

19) Improper input validation (CVE-ID: CVE-2026-70997)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read data or crash the application.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read data or crash the application.

20) Improper input validation (CVE-ID: CVE-2026-71026)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

21) Improper input validation (CVE-ID: CVE-2026-71015)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

22) Improper input validation (CVE-ID: CVE-2026-71014)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

23) Improper input validation (CVE-ID: CVE-2026-70994)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read data or crash the application.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read data or crash the application.

24) Improper input validation (CVE-ID: CVE-2026-70984)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to damange or delete data.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to damange or delete data.

25) Improper input validation (CVE-ID: CVE-2026-70981)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to damange or delete data.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to damange or delete data.

26) Improper input validation (CVE-ID: CVE-2026-70979)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to damange or delete data.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to damange or delete data.

27) Improper input validation (CVE-ID: CVE-2026-70978)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

28) Improper input validation (CVE-ID: CVE-2026-70977)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to damange or delete data.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to damange or delete data.

29) Improper input validation (CVE-ID: CVE-2026-70976)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to damange or delete data.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to damange or delete data.

30) Improper input validation (CVE-ID: CVE-2026-71037)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

31) Improper input validation (CVE-ID: CVE-2026-70998)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

32) Improper input validation (CVE-ID: CVE-2026-70995)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

33) Improper input validation (CVE-ID: CVE-2026-70982)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

34) Improper input validation (CVE-ID: CVE-2026-71019)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Internal operations component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

35) Improper input validation (CVE-ID: CVE-2026-71011)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

36) Improper input validation (CVE-ID: CVE-2026-71006)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

37) Improper input validation (CVE-ID: CVE-2026-71005)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

38) Improper input validation (CVE-ID: CVE-2026-71004)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

39) Improper input validation (CVE-ID: CVE-2026-71031)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

40) Improper input validation (CVE-ID: CVE-2026-71025)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

41) Improper input validation (CVE-ID: CVE-2026-70991)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A local non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

42) Improper input validation (CVE-ID: CVE-2026-70989)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

43) Improper input validation (CVE-ID: CVE-2026-71001)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.

44) Improper input validation (CVE-ID: CVE-2026-71017)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

45) Improper input validation (CVE-ID: CVE-2026-71008)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote privileged user can exploit this vulnerability to gain access to sensitive information.

46) Improper input validation (CVE-ID: CVE-2026-71007)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote privileged user can exploit this vulnerability to gain access to sensitive information.

47) Improper input validation (CVE-ID: CVE-2026-70990)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

48) Improper input validation (CVE-ID: CVE-2026-70983)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

49) Improper input validation (CVE-ID: CVE-2026-71033)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

50) Improper input validation (CVE-ID: CVE-2026-70992)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A local authenticated user can exploit this vulnerability to execute arbitrary code.

51) Improper input validation (CVE-ID: CVE-2026-71012)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to read and manipulate data.

52) Improper input validation (CVE-ID: CVE-2026-71003)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to read and manipulate data.

53) Improper input validation (CVE-ID: CVE-2026-71032)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

54) Improper input validation (CVE-ID: CVE-2026-71030)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

55) Improper input validation (CVE-ID: CVE-2026-71009)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

56) Improper input validation (CVE-ID: CVE-2026-71034)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Forge component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

57) Out-of-bounds write (CVE-ID: CVE-2024-9143)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when using the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial. A remote attacker can send specially crafted input to the server, trigger an out-of-bounds write and perform a denial of service (DoS) attack.

Note, the vulnerability can be exploited against the application in rare cases only that involve "exotic" curve encoding.

58) Infinite loop (CVE-ID: CVE-2022-23437)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when parsing XML documents. A remote attacker can supply a specially crafted XML document, consume all available system resources and cause denial of service conditions.

59) Improper input validation (CVE-ID: CVE-2026-71038)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

60) Improper input validation (CVE-ID: CVE-2026-71023)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

61) Improper input validation (CVE-ID: CVE-2026-70987)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

62) Improper input validation (CVE-ID: CVE-2026-70986)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

63) Improper input validation (CVE-ID: CVE-2026-70985)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cspuaug2026.html