Oracle Commerce CVE-2026-70980

The attacker needs network HTTP access to the Content Acquisition System (CAS) component of Oracle Commerce Guided Search / Experience Manager 11.4.0; per the CVSS vector (PR:N/UI:N) no authentication and no user interaction are required. The principal limiting factor is AC:H - Oracle classifies this as difficult to exploit, indicating the attacker must overcome a condition outside their control (e.g., a specific configuration, race, or environmental state) rather than firing a single reliable request; exploitation is further bounded to the exact supported version 11.4.0 and to deployments where the CAS HTTP endpoint is reachable by the attacker. Organizations that keep CAS on an isolated management network materially reduce exposure.

The signals here are deliberately mixed and should be read together. CVSS 3.1 is 9.0 (Critical), driven by network reach, no privileges, no user interaction, full C/I/A impact, and a scope change (S:C) - but the AC:H metric means Oracle assesses meaningful attacker effort or preconditions, which is why the score lands at 9.0 rather than 9.8/10.0. Counterbalancing the high base score, there is no KEV listing and no public exploit or POC identified at time of analysis, and no EPSS value was provided, so real-world exploitation pressure appears low-to-unproven today despite the critical rating; realistically this is a patch-urgently-but-not-panic item for the specific organizations that actually run this product. Because takeover plus scope change can pivot into adjacent systems, any operator still on 11.4.0 - from a large retailer down to a mid-sized deployment - should prioritize the Oracle CPU patch rather than deferring on the assumption that AC:H makes it impractical.

An attacker who can reach the Oracle Commerce CAS HTTP interface from the network sends specially crafted content-acquisition requests that abuse the ingestion pipeline to execute their goal without any credentials or user interaction. Given the difficult-to-exploit rating (AC:H), the attacker likely needs specific conditions, timing, or knowledge of the deployment to succeed, but a successful attempt results in takeover of Guided Search / Experience Manager and, via the scope change, impact on additional connected systems. No public POC is identified at time of analysis, so this scenario is inferred from the CVSS vector and Oracle's impact description rather than observed exploit code.