Oracle Commerce CVE-2026-71002

Exploitation requires a low-privileged account with network access to the Oracle Commerce Experience Manager HTTP interface - consistent with the CVSS PR:L and AV:N metrics. The authentication bypass tag suggests that the privilege barrier for triggering the vulnerability may be lower than a standard low-privilege account implies, potentially meaning minimal or weak credentials suffice. No special non-default configuration is stated as required; the vulnerability appears to affect the standard 11.4.0 deployment. Exploitation is limited by the need for at least some form of authentication (PR:L, not PR:N), and the specific version constraint of 11.4.0. No platform-specific OS or deployment-mode prerequisite is documented in the available data.

The CVSS 3.1 base score of 8.5 is substantiated by the vector components: network-accessible (AV:N), low complexity (AC:L), low privilege required (PR:L), no user interaction (UI:N), and a scope change (S:C) with high integrity and low confidentiality impact. The scope change elevates the score and real-world risk meaningfully - attackers are not confined to the directly vulnerable component. The authentication bypass tag further corroborates that the PR:L barrier may be easier to overcome than it appears. EPSS data is not present in the provided intelligence, so probability-of-exploitation cannot be quantified from that source. No CISA KEV listing exists, and no public exploit code has been identified, which tempers immediate urgency somewhat. However, Oracle Commerce is present in mid-to-large enterprise retail and B2B environments, meaning even a moderately resourced attacker targeting a specific organization's commerce platform could leverage this to tamper with product catalog data, pricing, or merchandising rules - high-business-impact outcomes even without code execution. The missing CWE assignment reduces precision in root-cause-based prioritization; defenders should verify the exact vulnerable component with Oracle's August 2026 CPU advisory.

An attacker with a low-privileged account on the Oracle Commerce platform - such as a restricted business user or a compromised service account - sends crafted HTTP requests to the Experience Manager component, bypassing authorization checks to modify critical commerce data such as product catalog entries, pricing rules, or promotional configurations. Because the vulnerability carries a scope change, the tampered data or escalated actions may propagate to other Oracle Commerce components or downstream systems. No public exploit code has been identified at time of analysis, but the low attack complexity means exploitation does not require specialized tooling.