NCSC-2026-0308 [1.00] [M/H] Vulnerabilities resolved in Oracle Commerce Platform
Oracle has resolved multiple vulnerabilities in Oracle Commerce Platform version 11.4.0. The vulnerabilities enable unauthenticated attackers with network access to perform critical actions without authentication. This includes obtaining unauthorized access to sensitive data, modifying, deleting or creating critical data, and causing denial-of-service (DoS) conditions. Some vulnerabilities require physical network access or user interaction, while others can be completely exploited remotely and without authentication. The vulnerabilities can lead to complete system compromise, affecting confidentiality, integrity and availability of the systems. Additionally, there are vulnerabilities that allow attackers with limited privileges or infrastructure access to escalate their rights and thus gain more control over the system. The issues are related to insufficient access control and authentication within the affected components of Oracle Commerce software.
CSIRTS triage
- What
- Multiple vulnerabilities enable unauthenticated attackers with network access to bypass authentication, access sensitive data, modify or delete critical data, and cause denial-of-service.
- Who is affected
- Oracle Commerce Platform 11.4.0 deployments with network exposure.
- Urgency
- Critical; unauthenticated remote attackers can perform critical actions and achieve complete system compromise affecting confidentiality, integrity, and availability.
- Action
- Apply Oracle's security patches for Oracle Commerce Platform 11.4.0 addressing all listed CVEs immediately.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Oracle Commerce Platform
Get an email when a new Oracle Commerce Platform advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0308
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Moderate exploitation riskCVE-2022-234374.4% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 91% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2024-91435.8% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 93% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-709530.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-709540.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-709550.20% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 10% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-709760.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-709770.41% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-709780.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-709790.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-709800.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
Referenced CVEs
+12 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [HIGH] Oracle Commerce: Multiple Vulnerabilitiescert-bund
- highCVE-2026-71032: Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager produc…nvd
- mediumCVE-2026-71031: Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager produc…nvd
- highCVE-2026-71030: Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager produc…nvd
- highCVE-2026-71028: Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager produc…nvd
- highCVE-2026-71027: Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager produc…nvd
- criticalCVE-2026-71026: Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager produc…nvd
- mediumCVE-2026-71025: Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager produc…nvd
- highCVE-2026-71024: Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager produc…nvd
- highCVE-2026-71023: Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager produc…nvd
- highCVE-2026-71022: Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager produc…nvd
- highCVE-2026-71021: Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager produc…nvd
More from NCSC-NL Advisories
- unknownNCSC-2026-0303 [1.01] [M/H] Vulnerabilities patched in GitLab by GitLab Inc.2026-08-25
- unknownNCSC-2026-0326 [1.00] [M/H] Vulnerabilities patched in Keycloak2026-08-25
- unknownNCSC-2026-0325 [1.00] [M/H] Vulnerabilities patched in Atlassian products2026-08-24
- unknownNCSC-2026-0324 [1.00] [M/H] Vulnerability fixed in Zimbra Collaboration Suite2026-08-23
- unknownNCSC-2026-0323 [1.00] [M/H] Vulnerabilities fixed in Cisco Secure Workload2026-08-21