Oracle Commerce CVE-2026-61157

No special conditions beyond network reachability - remote unauthenticated exploitation against Oracle Commerce Guided Search / Experience Manager 11.4.0 over HTTP (AV:N/AC:L/PR:N/UI:N), consistent with the 'Authentication Bypass' tag. The concrete prerequisite is that the target's Experience Manager HTTP interface (the authoring/preview component) must be network-reachable by the attacker; deployments where Experience Manager is isolated behind a VPN, firewall allowlist, or authenticating reverse proxy are not directly exploitable. Impact is limited to reading data (C:H, I:N, A:N) - the flaw does not by itself permit modification or denial of service. The single confirmed affected version is 11.4.0.

The signals are moderately but not uniformly alarming. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N is the worst case for exposure - network reachable, low complexity, no privileges, no user interaction - and Oracle explicitly calls it 'easily exploitable,' which raises priority for any internet- or intranet-facing deployment. However, scope is unchanged and impact is confined to confidentiality (C:H, I:N, A:N), so this is a data-exposure issue, not RCE or a takeover, capping the base score at 7.5. No EPSS score was supplied, no SSVC decision was provided, there is no POC reference, and it is absent from CISA KEV, so there is no evidence of active or automatable exploitation yet. Net: treat as a real but bounded priority - patch promptly on exposed instances, but the absence of KEV/POC/EPSS data means the realistic near-term exploitation likelihood is unconfirmed rather than proven high.

An attacker who can reach the Experience Manager HTTP interface sends a crafted request to a configuration or content endpoint that fails to enforce authentication, and receives back merchandising rules, catalog configuration, or other restricted Guided Search data without any credentials. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no login, social engineering, or complex preconditions are needed, and Oracle rates it 'easily exploitable.' No public exploit identified at time of analysis, so the scenario is inferred from the vector and Oracle's exploitability rating rather than a released POC.