Oracle Commerce CVE-2026-71001

Exploitation requires a valid low-privileged user account on the Oracle Commerce Experience Manager instance (PR:L per CVSS). Network access to the application via HTTP is required. No user interaction from another party is needed. The vulnerability affects only version 11.4.0 of Oracle Commerce Guided Search and Experience Manager; other versions are not confirmed affected. Limiting factors include the need for at least one valid credential - unauthenticated remote exploitation is not indicated by the CVSS vector. Environments that restrict account creation or tightly control low-privileged account distribution have meaningfully reduced exposure. No specific non-default configuration is documented as a prerequisite.

The CVSS 3.1 base score of 6.5 reflects a medium-severity issue with high confidentiality impact, but real-world risk is modulated by the PR:L requirement - an attacker must first obtain a valid low-privileged account. The 'Authentication Bypass' tag creates a slight tension: CVSS PR:L implies some authentication is required, yet the tag suggests authorization controls are being bypassed. This is consistent with an authenticated-but-unauthorized data access pattern (e.g., a low-privileged user accessing admin-level data). No EPSS score is available in the provided data, no KEV listing exists, and no POC has been identified, all of which reduce urgency relative to the CVSS score alone. Attack complexity is low and no user interaction is required, so exploitation is mechanically trivial once credentials are obtained. In environments where Oracle Commerce accounts are broadly distributed or where self-registration is permitted, effective risk rises significantly. The 'complete access to all Oracle Commerce Experience Manager accessible data' language in the description suggests broad data exposure, not just partial information leakage.

An attacker with a valid low-privileged Oracle Commerce account - obtained through credential theft, phishing, or self-registration if permitted - sends crafted HTTP requests to the Experience Manager component. By exploiting the authorization bypass, the attacker retrieves sensitive commerce data such as customer records, pricing rules, or merchandising configurations that should be restricted to higher-privileged roles. No public exploit code has been identified at time of analysis.