Oracle Commerce CVE-2026-61161

Exploitation requires network reachability to the Endeca Application Controller's HTTP interface of an Oracle Commerce Guided Search / Experience Manager 11.4.0 deployment; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special product configuration are called out, so against a reachable, default 11.4.0 instance it is unauthenticated and low-complexity. The principal limiting factor is exposure of the EAC endpoint: the controller is normally an internal management service, so deployments that keep it on a segmented management network, behind a firewall, or otherwise not reachable by the attacker sharply reduce real exploitability. Version is a hard limiter - only 11.4.0 is identified as affected.

All available severity signals point the same direction on paper: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a low-complexity, network-reachable, unauthenticated attack with no user interaction and complete compromise of confidentiality, integrity, and availability, yielding a 9.8 base score, and Oracle explicitly characterizes it as 'easily exploitable.' However, real-world risk signals are thinner: there is no EPSS score provided, no proof-of-concept identified, and it is not in CISA KEV, so there is currently no evidence of in-the-wild exploitation - the score reflects potential, not confirmed activity. The vendor's 'Information Disclosure' tag is narrower than the description's 'takeover' claim, a minor inconsistency worth noting: treat the broader full-compromise description as authoritative. The most important mitigating factor is exposure - Endeca Application Controller is typically an internal back-office/management service, so risk is dominated by whether the EAC HTTP interface is network-reachable by an attacker; internet-exposed or flat-network deployments are genuinely critical, while properly segmented deployments are meaningfully lower risk despite the 9.8.

An attacker who can reach the Endeca Application Controller's HTTP interface - for example an exposed or improperly segmented Oracle Commerce management endpoint - sends crafted requests directly to the controller without any credentials or user interaction. Exploiting the low-complexity flaw, the attacker gains control of the Endeca application stack, enabling data theft, manipulation of search/merchandising content, or service disruption. No public proof-of-concept is currently identified, so exploitation would require original development.