Oracle Commerce CVE-2026-70994

Requires network reachability to the Endeca Application Controller HTTP interface of Oracle Commerce Guided Search / Experience Manager 11.4.0; per CVSS AV:N/AC:L/PR:N/UI:N no authentication, user interaction, or non-default configuration is needed to trigger it. The practical limiting factor is exposure: EAC is frequently deployed on internal or management-only networks, so exploitation depends on whether that HTTP endpoint is reachable by the attacker. Only version 11.4.0 is listed as affected, which bounds the vulnerable population.

The signals align toward genuine priority: CVSS 3.1 9.1 with AV:N/AC:L/PR:N/UI:N means remote, unauthenticated, low-complexity exploitation with no user interaction, and Oracle explicitly labels it 'easily exploitable.' Confidentiality (C:H) and availability (A:H) are both fully impacted while integrity is untouched (I:N), consistent with an information-disclosure-plus-DoS bug rather than code execution. There is no CISA KEV listing and no public exploit identified, and EPSS is not provided, so there is no evidence of mass exploitation yet - but absence of a POC should not lower urgency for an internet-reachable, auth-free critical flaw, and any operator running the affected 11.4.0 build should treat this as urgent and patch in the current Oracle Critical Patch Update cycle. The main open question is exposure surface: EAC is often deployed on internal management networks, so real-world risk hinges on whether the affected endpoint is reachable from untrusted networks.

An attacker who can reach the Endeca Application Controller HTTP interface sends crafted requests to unauthenticated management endpoints and retrieves sensitive application/catalog data, then issues requests that hang or repeatedly crash the service to take Guided Search offline. No credentials, user interaction, or special client are required, and no public POC is currently known.