Oracle Commerce CVE-2026-70987

No special conditions are required beyond network-level HTTP access to the Oracle Commerce 11.4.0 instance - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against default configurations of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. The Content Acquisition System component must be deployed and reachable over HTTP, which is standard in any functional Oracle Commerce installation. Exploitation is limited to version 11.4.0 specifically; other versions are not stated as affected. The impact is bounded to confidentiality - attackers cannot modify data or disrupt availability through this flaw alone. Internet-exposed deployments face the highest realistic risk; deployments isolated behind VPN or internal network controls have materially reduced exposure.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects a high-severity information disclosure: no network restrictions, no complexity barriers, and no authentication gate stand between an attacker and complete data access. The scope is unchanged (S:U), meaning lateral movement into other systems is not implied by the vulnerability itself. No EPSS score was supplied, so exploitation probability cannot be quantified; however, the trivial attack conditions (AC:L/PR:N) are characteristic of flaws that attract rapid opportunistic scanning once details are public. This is not in CISA KEV and no POC is publicly known at time of analysis, which moderates immediate urgency slightly, but the authentication bypass nature means any internet-exposed instance of Oracle Commerce 11.4.0 should be treated as a critical remediation priority. The impact is confidentiality-only (I:N/A:N), so data destruction or service disruption are not direct risks from this CVE, but full data exfiltration from a commerce platform - including product pricing, customer data, and catalog configurations - carries significant business and regulatory consequence.

An unauthenticated attacker with HTTP access to an Oracle Commerce 11.4.0 deployment sends a crafted request directly to the Content Acquisition System endpoint, bypassing the authentication layer. The attacker receives a full response containing the platform's indexed commerce data - potentially including product catalog details, pricing structures, customer segment configurations, and internal merchandising rules - without presenting any credentials. No public exploit code is known at time of analysis, but the trivial exploitation conditions suggest a working exploit would require minimal effort to develop once the authentication bypass mechanism is identified.