Oracle Commerce Experience Manager CVE-2026-70983

Exploitation requires network access to the Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 Content Acquisition System (CAS) over HTTP. Per the CVSS vector PR:N, no credentials or authenticated session are required. Per AC:H, exploitation is not trivially reproducible against all targets - specific environmental or configuration conditions must align, though Oracle has not publicly disclosed what those conditions are. The scope change (S:C) indicates that successful exploitation in CAS can cascade into other Oracle Commerce components. Exploitation is limited by: the AC:H complexity constraint meaning a subset of 11.4.0 deployments may be vulnerable depending on configuration state; the narrow version scope of exactly 11.4.0 (no other versions confirmed affected); and the requirement that CAS HTTP interfaces be reachable from the attacker's network position - deployments where CAS is isolated to internal networks or behind strict ingress controls reduce exposure significantly.

The official CVSS 3.1 score of 6.8 reflects a Medium-severity finding elevated by scope change (S:C) and high confidentiality impact (C:H), partially offset by high attack complexity (AC:H). The AC:H constraint is the primary risk moderator - exploitation is not straightforward and likely requires a specific environmental condition, race condition, or non-default configuration path to be triggered. No EPSS data was provided, so exploitation probability cannot be quantified from base rates. The vulnerability is not in the CISA KEV catalog and no POC or exploit code has been identified, suggesting this has not been publicly weaponized. The scope change is a meaningful signal: a successful attacker in the CAS component may be able to read data from other Oracle Commerce subsystems, increasing the effective blast radius. Real-world priority should be moderate - the authentication bypass tag and unauthenticated vector are concerning for internet-exposed deployments, but AC:H and the narrow version scope (11.4.0 only) limit the population at immediate risk. Organizations with Oracle Commerce 11.4.0 exposed to untrusted networks should treat this as high priority; air-gapped or internally-accessible-only deployments face substantially reduced risk.

An unauthenticated remote attacker sends a specially crafted HTTP request to the Content Acquisition System endpoint of an Oracle Commerce 11.4.0 deployment that is accessible over the network. By exploiting the authentication bypass under the specific high-complexity conditions required (exact nature of conditions not disclosed by Oracle), the attacker bypasses identity enforcement in CAS and gains unauthorized read access to all data indexed or accessible by the Oracle Commerce platform, potentially including product catalogs, pricing data, customer-facing content configurations, and integrated data from adjacent Oracle systems due to the scope change.