Oracle Commerce Platform CVE-2026-70955

The attacker must reside on the same physical communication segment (subnet, VLAN, or broadcast domain) as the hardware running Oracle Commerce Platform 11.4.0 - this is the AV:A constraint and is the primary limiting factor. Remote internet-based exploitation is not possible. No authentication is required (PR:N), meaning any adjacent host can attempt the attack without credentials. However, the high attack complexity (AC:H) means additional conditions beyond the attacker's direct control must be satisfied; Oracle has not disclosed the specific preconditions (likely a protocol state, timing window, or component configuration) due to their standard CPU disclosure policy. Only version 11.4.0 is confirmed affected. The 'Information Disclosure' tag in the ENISA metadata does not align with the full takeover impact described - defenders should not use the tag to downgrade their risk assessment. What limits exploitation: adjacency requirement eliminates internet exposure; AC:H requires difficult-to-reproduce conditions; the exact exploitation mechanism is undisclosed, raising the bar for weaponization.

The vendor-assigned CVSS 3.1 score of 7.5 accurately reflects a serious but operationally constrained flaw. The adjacent-only attack vector (AV:A) is the single most important risk-reduction factor: internet-facing exploitation is not possible, meaning attackers must already have a foothold in the same network segment through a separate vector (e.g., a compromised peer host, physical access, or shared cloud infrastructure). The high complexity (AC:H) further reduces real-world exploit probability, as reproducible exploitation likely requires specialized protocol knowledge or difficult-to-control environmental conditions. No EPSS data was available in the provided input, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no publicly available POC code indicate no confirmed in-the-wild exploitation at the time of this analysis. The metadata tag 'Information Disclosure' conflicts with the full C:H/I:H/A:H impact rating suggesting complete takeover - this discrepancy is not resolved by available data and may reflect an incomplete tagging of the CPU entry rather than a bounded scope of impact. Organizations running Oracle Commerce Platform 11.4.0 in shared or poorly segmented network environments (co-location facilities, flat enterprise LANs, multi-tenant clouds) should treat this as a meaningful priority. Well-segmented deployments face materially lower risk.

An attacker who has compromised a host sharing the same network segment as the Oracle Commerce Platform server - for example, a co-located application server, a pivot from a different compromised internal system, or a malicious insider - sends specially crafted protocol traffic targeting the Dynamo Application Framework. After satisfying the high-complexity preconditions (the exact nature of which Oracle has not disclosed), the attacker achieves complete control over the Commerce Platform, enabling exfiltration of customer and transaction data, modification of catalog or order data, or denial of service to the platform.