Oracle Commerce Experience Manager CVE-2026-71000

The attacker must hold a valid low-privileged account on the Oracle Commerce platform (CVSS PR:L confirmed). The attack is delivered over HTTP network access (AV:N), meaning the Experience Manager interface must be reachable from the attacker's position. Exploitation additionally requires a separate human victim - a person other than the attacker - to perform an interaction with the attacker-influenced content (UI:R), such as viewing a page or clicking a link within the Oracle Commerce application. This human-interaction requirement is the primary limiting factor: automated, fully opportunistic exploitation is not possible without social engineering or waiting for organic victim activity. The 'Authentication Bypass' tag suggests the bypass operates through the victim's elevated session rather than granting the attacker direct unauthenticated access - exploitation is thus conditional on the victim being an authenticated, higher-privileged user active in the system. Non-default or specially configured deployments are not identified as prerequisites; any standard Oracle Commerce Guided Search / Experience Manager 11.4.0 installation accessible over HTTP is considered in scope.

The CVSS 3.1 base score of 8.7 reflects genuinely high severity: network-reachable, low attack complexity, only low privileges required, and a scope change with full confidentiality and integrity compromise. However, the mandatory user interaction (UI:R) and the low-privilege prerequisite moderate the opportunistic exploitation risk - this is not a fire-and-forget unauthenticated attack. No EPSS data was provided in the intelligence feed, and the vulnerability does not appear in the CISA KEV catalog at time of analysis, meaning confirmed active exploitation is not established. The 'Authentication Bypass' tag warrants scrutiny: the CVSS PR:L metric indicates the attacker must hold some level of credentials, so 'bypass' likely refers to escalating effective access through a victim's higher-privileged session rather than fully unauthenticated access - these signals are not fully consistent and should be verified against the Oracle advisory. Even so, any organization running Oracle Commerce 11.4.0 - from large retail enterprises down to a mid-sized municipal IT team in rybnik operating an e-commerce portal - should treat this as an urgent patching priority given the potential for complete data exfiltration and unauthorized data modification across Commerce subsystems. The absence of a formal CWE assignment limits automated tooling detection and means manual triage is needed.

An attacker with a low-privileged Oracle Commerce account crafts and submits malicious content - such as a stored script payload - into a field rendered by the Experience Manager component. When a higher-privileged user (such as an administrator or content editor) views or interacts with the affected page, the payload executes in their browser session, granting the attacker read and write access to critical Commerce data within the scope of the victim's session, potentially including product catalog data, customer records, or Experience Manager configurations. No public exploit code or proof-of-concept has been identified at time of analysis.