Oracle Commerce CVE-2026-70998

Exploitation requires HTTP network access to the Endeca Application Controller service of an Oracle Commerce Guided Search / Experience Manager 11.4.0 deployment; no credentials, user interaction, or non-default configuration are needed (AV:N/AC:L/PR:N/UI:N), so any reachable EAC endpoint is exploitable. The primary limiting factors are network reachability and version: only supported version 11.4.0 is named as affected, and EAC is frequently deployed on internal management networks rather than exposed to the internet - deployments that keep the controller off untrusted networks materially reduce real-world exposure even though the CVSS vector itself imposes no such constraint.

This is a genuine high-priority issue rather than a paper-tiger high score: the CVSS vector (AV:N/AC:L/PR:N/UI:N) describes low-complexity, unauthenticated, network-reachable exploitation, and Oracle explicitly calls it 'easily exploitable,' which is a strong signal on its own. The dominant impact is confidentiality (C:H) - unauthorized read of critical commerce data - with partial integrity damage (I:L) and no availability impact (A:N), and the scope change (S:C) is what pushes the score to 9.3. Countervailing signals are limited: there is no EPSS value supplied, no KEV listing, and no known public POC, so exploitation probability data is absent rather than reassuring - Oracle Critical Patch Update flaws historically attract reverse-engineering once the fix ships. Any organization running an internet-exposed or broadly network-reachable Endeca Application Controller should treat this as urgent and patch in the current Oracle CPU cycle; the missing EPSS/KEV data should not be read as low risk given the unauthenticated, easily-exploitable profile.

An attacker who can reach the Endeca Application Controller's HTTP interface sends a crafted request that bypasses authentication and invokes management/data functionality without any credentials, then reads sensitive commerce catalog, configuration, or customer-facing data and makes limited unauthorized modifications. Given AC:L and PR:N, no user interaction or special timing is needed; the scope change means the attacker may reach resources in managed applications beyond EAC itself. No public exploit code has been identified at time of analysis, but the low complexity makes independent weaponization plausible once the patch is analyzed.