Oracle Commerce CVE-2026-70985

Exploitation requires only HTTP network access to the Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 instance, specifically the Content Acquisition System component endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication is required, no user interaction is needed, and no special or non-default configuration is necessary beyond the CAS being network-reachable. The primary condition limiting exploitation is network exposure: organizations that restrict access to the Content Acquisition System to internal management networks or trusted hosts substantially reduce their attack surface. Only version 11.4.0 is confirmed affected per the vendor advisory; exploitation against other versions is not confirmed from available data.

The CVSS 3.1 base score of 7.5 (High) accurately reflects a significant real-world risk for organizations that expose the Content Acquisition System to untrusted networks. The attack vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no special configuration, and no user interaction is required - any attacker with HTTP reachability to the CAS endpoint can exploit this. The unchanged scope (S:U) limits lateral pivot through this vulnerability alone, and the absence of integrity or availability impact (I:N/A:N) narrows the damage to confidentiality. No EPSS score was provided in the source data, so quantitative exploitation probability cannot be assessed. The vulnerability is not listed in CISA KEV and no public proof-of-concept has been identified, suggesting opportunistic mass exploitation is not currently observed. However, the trivial exploitation conditions (no auth, low complexity) mean exploitation would be straightforward for any attacker who discovers the endpoint. The CVSS vector and description are fully consistent with no conflicting signals.

An attacker who identifies an internet-facing or intranet-accessible Oracle Commerce 11.4.0 instance sends a crafted unauthenticated HTTP request directly to the Content Acquisition System endpoint, bypassing the expected authentication check. Without supplying any credentials, the attacker retrieves all data accessible to the CAS - potentially encompassing the full product catalog, indexed page content, internal configuration metadata, and any other data the system has ingested. No public proof-of-concept code has been identified, but the low attack complexity means a motivated attacker could develop an exploit independently with minimal effort.