Oracle Commerce CVE-2026-70976

The specific prerequisite is network HTTP reachability to the Content Acquisition System component of Oracle Commerce Guided Search / Experience Manager 11.4.0 - per AV:N/AC:L/PR:N/UI:N there is no special configuration, authentication, or user interaction required beyond the attacker being able to send HTTP requests to the CAS service. The key limiting factor is deployment topology: CAS is commonly intended to run within a trusted back-office/indexing tier, so exploitation depends on whether that HTTP interface is exposed to the attacker's network position; the affected version is constrained to 11.4.0, and impact is limited to integrity and availability (no data confidentiality loss).

This is a genuine high-priority issue rather than an inflated high-CVSS score: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack, and the 9.1 base score is fully justified by combined High Integrity and High Availability impact - an attacker can both corrupt catalog/content data and take the search service down. Confidentiality impact is None, so the primary business risks are data integrity (poisoned or deleted catalog/index data feeding a live storefront) and outage. No EPSS score, KEV listing, or public POC was provided, so exploitation is not confirmed in the wild; the combination of trivial exploitability and an internet-facing e-commerce component nonetheless means that even a mid-sized retail IT team in swidnica should treat this as urgent and patch on Oracle's August 2026 CPU cycle rather than deferring. Because CAS is often intended to run inside a trusted back-office network, real-world exposure hinges on whether the ingestion port is actually reachable from untrusted networks - verify network placement to right-size urgency.

An attacker who can reach the Content Acquisition System's HTTP interface sends crafted unauthenticated requests to the ingestion/crawl endpoints, then either injects or deletes catalog and content records to corrupt the live storefront's search index, or issues a malformed request that hangs or crashes the service for a complete denial of service. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or unusual conditions are needed once the port is reachable; no public POC has been identified at time of analysis.