Oracle Commerce CVE-2026-70981

Exploitation requires network HTTP reachability to the Oracle Commerce Content Acquisition System (CAS) service of an Oracle Commerce Guided Search / Experience Manager 11.4.0 deployment; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no authentication, privilege, or user-interaction prerequisites and the attack complexity is low, so any actor able to route HTTP to the CAS endpoint can attempt it. The primary limiting factor is exposure: CAS is typically an internal indexing/back-office component, so risk is dominated by whether that service is inadvertently reachable from untrusted networks - deployments that keep CAS on a segmented internal network are materially harder to reach, while the affected scope is constrained to version 11.4.0. There is no configuration toggle named in the description, so treat any 11.4.0 instance with a network-accessible CAS as exploitable.

The signals are strong but partly one-sided. CVSS 3.1 is 9.1 with the most permissive exploitability profile possible (AV:N/AC:L/PR:N/UI:N), and Oracle itself flags it as 'easily exploitable,' which argues for high priority on any internet-reachable CAS deployment. However, C:N caps the blast radius to integrity and availability - there is no direct data exfiltration - so the risk is content/index corruption and outage, not breach. No EPSS score was provided, so exploitation probability cannot be quantified; there is no KEV listing and no POC in the input, meaning no evidence of active or imminent mass exploitation yet. No SSVC decision data was supplied. Net: treat as high priority where the CAS is network-exposed, but the absence of EPSS/KEV/POC suggests this is currently a patch-on-schedule critical rather than an emergency zero-day. Note the scope is Unchanged (S:U), so impact is confined to the Oracle Commerce instance itself.

An attacker who can reach the Content Acquisition System over HTTP sends crafted requests directly to the exposed CAS endpoints without any credentials, deleting or altering records in the content store to poison search results and merchandising, or issuing a malformed request that hangs the service. Because no authentication or user interaction is required (PR:N/UI:N/AC:L), the attack can be scripted and repeated to keep the storefront's search offline. No public exploit code is identified at time of analysis, so an attacker would need to develop the request against the CAS interface.