Oracle Commerce CVE-2026-70995

The one hard prerequisite is network HTTP reachability of the Endeca Application Controller component of Oracle Commerce Guided Search / Experience Manager 11.4.0. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and low complexity required against affected 11.4.0 deployments. The primary limiting factor is exposure: the EAC is intended as an internal management service, so environments that keep it segmented behind the perimeter sharply reduce realistic attack surface, and only version 11.4.0 is listed as affected.

The signals are strongly aligned toward high priority: CVSS 3.1 is 9.8 with AV:N/AC:L/PR:N/UI:N, i.e., remotely reachable, no authentication, no user interaction, and low complexity, culminating in high confidentiality, integrity, and availability impact. Countervailing signals are largely absent from the data rather than reassuring: no EPSS score is provided, there is no CISA KEV listing, and no proof-of-concept is referenced, so there is no evidence of active or automated exploitation yet. The tag 'Information Disclosure' partially conflicts with Oracle's 'takeover' wording and the full-impact vector - treat the vector (complete compromise) as authoritative and the tag as an incomplete label. Net: a genuine top-tier priority on exposure grounds, tempered only by the fact that widespread exploitation has not been demonstrated and the affected product has a limited deployment base.

An attacker who can reach the Endeca Application Controller's HTTP interface over the network sends a single crafted, unauthenticated request that abuses the EAC control functionality to gain administrative control of the deployment. From there they can alter search/merchandising configuration, exfiltrate data, or disrupt the storefront's guided-search tier. No public exploit code is currently identified, so this reflects the capability implied by the CVSS vector rather than an observed campaign.