Oracle Commerce Guided Search CVE-2026-61145

The attacker needs network HTTP access to the Content Acquisition System interface of an Oracle Commerce Guided Search / Experience Manager 11.4.0 deployment; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no special privileges, and no user interaction are required against that reachable service. In practice the primary limiting factor is network exposure of the CAS endpoint - deployments that keep CAS on an isolated internal/management network rather than internet-facing sharply reduce reachability - plus the version constraint (only 11.4.0 is named as affected). No non-default feature toggle or specific configuration setting is called out in the description as a prerequisite, so exploitability turns on reachability of the CAS HTTP service rather than on an optional feature being enabled.

The signals are strongly aligned toward high real-world risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) indicates network-reachable, low-complexity, unauthenticated, no-user-interaction exploitation with full CIA impact, and Oracle explicitly labels it 'easily exploitable' with a 'takeover' outcome - the most severe consequence category. Against that, the exploitation-maturity signals are currently empty: not in CISA KEV (no confirmed active exploitation), no POC referenced, and no EPSS score supplied in the intelligence, so probabilistic exploitation likelihood cannot be quantified from this data. There is no SSVC decision record provided. The tag 'Information Disclosure' understates the vendor's own 'takeover' language and full-integrity/availability impact - treat the CVSS/vendor description as authoritative over the tag. Net: this is a genuine priority driven by the unauthenticated-network-takeover profile, not a high-CVSS-but-low-real-risk case, with the only mitigating factor being that no exploit is yet public and the product footprint is limited.

An attacker who can reach the Oracle Commerce Content Acquisition System over HTTP sends a crafted request to the exposed CAS interface without any credentials, and because the flaw is low-complexity and requires no user interaction, the request results in full compromise ('takeover') of the Guided Search / Experience Manager instance. From there the attacker can read and alter the search index, catalog, and merchandising content and disrupt availability. No public POC is currently identified, so a working exploit would need to be developed or reverse-engineered from the patch.