This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager, specifically version 11.4.0. It is an easily exploitable flaw that permits unauthenticated attackers with network access over HTTP to compromise the system, leading to unauthorized access to sensitive or all accessible data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that the attack requires no privileges or user interaction and impacts confidentiality with high severity. The vendor advisory from Oracle references this vulnerability within their August 2026 Critical Security Patch Update but does not explicitly confirm patch availability for this specific CVE in the provided content.

Successful exploitation of this vulnerability results in unauthorized access to critical or all data accessible through Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. There is no reported impact on data integrity or system availability. The vulnerability is remotely exploitable without authentication, increasing the risk of data exposure.

Oracle's August 2026 Critical Security Patch Update advisory recommends applying security patches promptly to address vulnerabilities. However, the provided advisory content does not explicitly confirm a patch for CVE-2026-70986. Users of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and apply any relevant updates without delay. Until a patch is confirmed and applied, restrict network access to the affected service where possible.