Oracle Commerce Experience Manager CVE-2026-70999

Exploitation requires a valid low-privileged authenticated session with network access to the Oracle Commerce Experience Manager HTTP interface (PR:L per CVSS vector). The affected version is specifically 11.4.0. No user interaction from a victim is required (UI:N), and attack complexity is low (AC:L), meaning no special timing, race conditions, or additional preconditions are needed beyond authentication. Exploitation is bounded by the need for at least one valid low-privilege account - unauthenticated access is not confirmed from available data, despite the 'Authentication Bypass' tag, which may refer to intra-application authorization bypass rather than pre-authentication bypass. Scope is unchanged (S:U), meaning impact is contained to the Oracle Commerce application itself and does not extend to the underlying OS or adjacent systems.

The CVSS 3.1 score of 8.1 (High) is well-supported by the vector: network-accessible, low attack complexity, no user interaction, and dual high-severity impacts to confidentiality and integrity. The PR:L requirement is the sole friction point - an attacker must hold at least one valid low-privileged account. In enterprise Oracle Commerce deployments, such accounts may be broadly distributed (staff, API service accounts, partners). No EPSS score was provided, and there is no KEV listing or known POC at time of analysis, so real-world exploitation probability cannot be quantified from available signals. The 'Authentication Bypass' tag introduces ambiguity: if the bypass allows unauthenticated access despite the PR:L vector, actual risk may be higher than the CVSS score reflects - this discrepancy should be verified with Oracle's advisory. The absence of an availability impact (A:N) means the flaw is data-focused rather than disruptive.

An attacker with a valid low-privileged Oracle Commerce account - such as a staff member, partner portal user, or compromised service account - sends specially crafted HTTP requests to the Experience Manager component to bypass authorization controls. This grants the attacker read access to all commerce data (customer records, pricing, catalog configurations) and write access to modify or delete critical commerce assets. No public exploit code has been identified at time of analysis.