Oracle Commerce CVE-2026-70984

Exploitation requires network HTTP reachability to the Content Acquisition System component of Oracle Commerce Guided Search / Experience Manager 11.4.0; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and low complexity, so any attacker who can send HTTP requests to a default-configured, exposed CAS instance can exploit it. The primary limiting factor is network exposure: CAS is typically an internal ingestion tier, so deployments that do not expose the CAS HTTP interface to untrusted networks are not remotely reachable by external attackers. Exploitation is confined to version 11.4.0 of this specific product/component.

This is a genuine high-priority issue rather than an inflated high-CVSS score: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation, and the 9.1 base score is driven by High Integrity and High Availability impact with no confidentiality loss (C:N). No EPSS score was provided, the CVE is not in CISA KEV, and no proof-of-concept is referenced, so there is no evidence of active or automated exploitation yet - the risk is currently potential rather than observed. Given that CAS is normally an internal ingestion tier, real-world exposure hinges on whether the CAS HTTP interface is reachable from untrusted networks; where it is, even a mid-sized retail operator should treat this as urgent given the trivial exploitation conditions, while deployments that keep CAS firewalled to internal hosts have a materially lower immediate risk. The main uncertainty is CWE:N/A and the absence of EPSS/POC data, so exploitation likelihood cannot be precisely quantified from the inputs.

An attacker who can reach the Content Acquisition System HTTP endpoint sends a crafted unauthenticated request that modifies or deletes indexed content and catalog data, corrupting search results and merchandising, or issues a request that reliably hangs/crashes the service for a complete denial of service. Because no authentication or user interaction is required and attack complexity is low, this can be repeated at will; no public POC is currently identified, so an attacker would need to develop the request against the CAS interface.