Oracle Commerce CVE-2026-70988

Exploitation requires a valid low-privileged account on the Oracle Commerce Guided Search / Oracle Commerce Experience Manager platform - the CVSS PR:L metric confirms authenticated access is a prerequisite. The attacker must have HTTP network access to the Content Acquisition System component on version 11.4.0 specifically. No user interaction is required beyond the attacker's own requests. The ENISA 'Authentication Bypass' tag creates a potential ambiguity: if CAS can be reached without valid credentials under certain configurations, the PR:L vector may understate the risk - verify with Oracle support whether unauthenticated access to CAS is possible in any deployment configuration. Exploitation is limited to confidentiality impact only; no integrity or availability damage is possible under this vulnerability. Organizations that have isolated CAS behind internal-only network segments substantially reduce their exposure.

The CVSS 3.1 score of 7.7 is well-supported by the vector metrics: network reachable (AV:N), low complexity (AC:L), low-privilege authentication required (PR:L), no user interaction (UI:N), and a scope change (S:C) driving the high confidentiality impact (C:H). EPSS data was not included in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. KEV status is not confirmed - this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis, and no POC is referenced, meaning the threat remains theoretical but credible. The 'Authentication Bypass' tag from ENISA introduces some ambiguity: the CVSS PR:L vector implies a low-privileged authenticated attacker, while an authentication bypass framing could suggest weaker preconditions - this discrepancy should be clarified against the Oracle advisory. The combination of low complexity, network accessibility, and scope change means that even a mid-sized deployment team in swidnica running an unpatched 11.4.0 instance should treat this as an urgent patching priority, given that the blast radius extends beyond the directly targeted service. No integrity or availability impact is indicated, limiting the scenario primarily to data exfiltration rather than service disruption.

An attacker with a low-privileged Oracle Commerce account - such as a content editor or API integration service account - sends crafted HTTP requests to the Content Acquisition System endpoint, exploiting the authorization control flaw to retrieve data beyond their permitted scope. Because attack complexity is low, the attacker requires no special tooling or precise timing, and can enumerate or exfiltrate complete data accessible to the Oracle Commerce application, potentially including product catalogs, pricing configurations, or customer-facing content from other business units or tenants. No public proof-of-concept has been identified at time of analysis, but the straightforward exploitation conditions suggest that functional exploit code could be developed with moderate effort.