Oracle Commerce CVE-2026-70977

The attacker needs network HTTP reachability to the Content Acquisition System component of Oracle Commerce Guided Search / Experience Manager 11.4.0; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are required, so a network-exposed CAS instance in its supported configuration is exploitable. The primary limiting factor is exposure: the CAS/Endeca ingestion and administration interface must be reachable by the attacker - deployments that keep this component on an internal-only management network behind firewalls or ACLs substantially reduce reachable attack surface. Exploitation is also bounded to the specific affected release (11.4.0) and to the Content Acquisition System component.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1) signals a genuinely high-priority issue: network-reachable, low-complexity, no authentication, and no user interaction, with high integrity and availability damage. Oracle's own text reinforces this by calling it 'easily exploitable.' Counterbalancing signals are limited: it is NOT in CISA KEV (no confirmed active exploitation), no POC or exploit code was identified in the provided data, and no EPSS probability was supplied, so real-world exploitation likelihood cannot be quantified from the inputs. Confidentiality impact is explicitly None, so this is a tampering/availability threat, not data theft - an attacker can corrupt catalog/search data or take the search tier offline but cannot directly read sensitive data through this flaw. Net assessment: treat as a real, patch-now priority for anyone still running Endeca-based Oracle Commerce, while noting that active exploitation is unconfirmed and this is a legacy product with a shrinking footprint.

An attacker who can reach the Oracle Commerce Content Acquisition System over HTTP sends crafted unauthenticated requests to the exposed endpoint, allowing them to inject, alter, or delete catalog/search records - poisoning storefront search results - or to send a malformed request that hangs or repeatedly crashes the service for a complete denial of service. Given AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are required; however, no public exploit code was identified at time of analysis.