Oracle Commerce Experience Manager vulnerabilities

82 CVEs affecting Oracle Commerce Experience Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-71035, published 2026-08-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-20190, published 2021-01-19. High severity, CVSS 8.1. EPSS: 7.6% chance of exploitation in the next 30 days. A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data…
CVE-2020-2604, published 2020-01-15. High severity, CVSS 8.1. EPSS: 4.9% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE…
CVE-2015-0495, published 2015-04-16. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.x and 11.x allows remote attackers to affect…
CVE-2020-14536, published 2020-07-15. High severity, CVSS 7.4. EPSS: 1.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Workbench). Supported versions that are affected are 11.0, 11.1, 11.2…
CVE-2021-2348, published 2021-07-21. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks). The supported version that is affected is…
CVE-2021-2345, published 2021-07-21. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks). The supported version that is affected is…
CVE-2021-2346, published 2021-07-21. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks). The supported version that is affected is…
CVE-2026-70995, published 2026-08-18. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected…
CVE-2026-61161, published 2026-07-21. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected…
CVE-2026-61145, published 2026-07-21. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is…

Latest

CVE-2026-71035, published 2026-08-18. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to…
CVE-2026-71034, published 2026-08-18. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily…
CVE-2026-71033, published 2026-08-18. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected…
CVE-2026-71032, published 2026-08-18. High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected…
CVE-2026-71031, published 2026-08-18. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected…
CVE-2026-71030, published 2026-08-18. High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected…
CVE-2026-71028, published 2026-08-18. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected…
CVE-2026-71027, published 2026-08-18. High severity, CVSS 7.6. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected…
CVE-2026-71026, published 2026-08-18. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected…
CVE-2026-71025, published 2026-08-18. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected…