Oracle Commerce Guided Search CVE-2026-70982

Exploitation requires network access to the Oracle Commerce Content Acquisition System HTTP interface running version 11.4.0. No credentials are required (confirmed by PR:N in the CVSS vector), and no user interaction is needed (UI:N). However, the CVSS AC:H metric indicates that specific conditions must align for exploitation to succeed - Oracle applies AC:H when exploitation depends on a race condition, a non-default configuration state, or technical prerequisites that the attacker cannot guarantee independently. The exact technical precondition (whether a specific CAS operating mode, endpoint configuration, or timing window is required) is not detailed in the available intelligence. Exploitation is not platform-restricted. The primary limiting factors are: the CAS HTTP interface must be network-reachable by the attacker, and the high attack complexity condition must be satisfiable - this materially raises the bar above trivial automated scanning.

The overall risk profile is moderate-to-serious despite the high attack complexity modifier. The CVSS AC:H metric explicitly signals that exploitation requires conditions the attacker cannot fully control, which meaningfully reduces the probability of widespread automated exploitation compared to AC:L vulnerabilities; however, this is not equivalent to low risk for targeted attacks against known Oracle Commerce deployments. EPSS data was not provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. The CVE is absent from the CISA KEV catalog and no POC has been identified, suggesting no confirmed broad exploitation at time of writing. Despite these mitigating signals, the combination of S:C and C:H is the most operationally significant factor - a successful attacker gains access to critical commerce data beyond the immediate target component, meaning that even a mid-sized municipal procurement operation in inowroclaw running Oracle Commerce for public e-tendering should treat this as a priority remediation rather than a deferred patching item. The primary realistic threat is a sophisticated, targeted attacker who can engineer the required exploitation conditions, not opportunistic automated scanning.

An unauthenticated attacker with HTTP network access to the Oracle Commerce Content Acquisition System endpoint sends a specially crafted request that satisfies the high-complexity exploitation condition and bypasses authentication controls, gaining read access to all data accessible to the CAS component. Due to the CVSS scope change, the attacker may subsequently access sensitive product catalog, pricing, or customer data from integrated backend systems within the Oracle Commerce ecosystem. No public exploit code has been identified at time of analysis, and the AC:H requirement means exploitation is most plausible from a targeted attacker who has prior knowledge of the specific deployment configuration.