Oracle Commerce CVE-2026-70979

The vulnerable surface is the Content Acquisition System (CAS) HTTP interface of Oracle Commerce Guided Search / Experience Manager 11.4.0; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation is possible against an affected 11.4.0 deployment whose CAS is reachable over the network. The primary limiting factor is network exposure: CAS is an internal ingestion/administration tier and in many deployments is not directly internet-facing, so exploitation depends on the attacker having HTTP reach to that service. Only version 11.4.0 is confirmed affected, and the impact is confined to integrity and availability (C:N) - the attacker cannot read data through this flaw.

The signals largely agree that this is a genuine high priority for anyone still running Oracle Commerce 11.4.0. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes trivial remote, unauthenticated, low-complexity exploitation, and Oracle's own text calls it 'easily exploitable,' which is why the base score reaches 9.1 despite C:N. The impact is scoped to integrity and availability: attackers can corrupt or destroy catalog/index data and take the search service fully offline (complete DOS), but cannot directly read confidential data through this flaw. Tempering the urgency: no EPSS score was supplied, there is no POC and no CISA KEV listing, and no CWE or SSVC decision data is available, so real-world exploitation appears theoretical rather than observed at this time. The product's limited deployment footprint further narrows the realistic attacker interest to targeted rather than mass exploitation. Net: patch promptly if exposed, but the absence of active-exploitation evidence means this is a serious-but-not-emergency item relative to internet-facing KEV-listed bugs.

An attacker who can reach the Content Acquisition System's HTTP interface sends a crafted request without any credentials and, because attack complexity is low, reliably triggers unauthorized modification or deletion of indexed catalog data or forces the service into a repeatable crash. This can wipe or poison the storefront's search index and take Guided Search fully offline (complete DOS). No public POC is currently identified, so exploitation would require an attacker to independently develop the technique.