Oracle Commerce Experience Manager CVE-2026-71006

Exploitation requires that a victim user with an active Oracle Commerce session interact with an attacker-controlled link or page - typically by clicking a phishing link or visiting a page embedding a crafted request. The vulnerable endpoint must be reachable over HTTP from the attacker's network, which in customer-facing deployments is the default internet-accessible posture. No authentication is required of the attacker (PR:N). Exploitation is limited by the mandatory user interaction requirement (UI:R): passive, drive-by exploitation against users who do not interact with attacker-supplied content is not possible. The vulnerability is specific to Oracle Commerce Guided Search / Experience Manager version 11.4.0; other Oracle Commerce components or versions are not confirmed affected. The 'Authentication Bypass' tag may imply the XSS payload can be used to steal credentials or session tokens, effectively bypassing authentication downstream, but direct authentication bypass without user interaction is not supported by the CVSS vector.

The CVSS 3.1 base score of 6.1 (Medium) accurately reflects the constrained impact: exploitation requires victim interaction (UI:R), and impacts are limited to low confidentiality and integrity - consistent with XSS enabling session theft or limited data manipulation, not full system compromise. No EPSS score was provided in the intelligence data; without it, exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept exploit has been identified, reducing the urgency compared to a KEV-listed finding. The 'Authentication Bypass' tag is inconsistent with the CVSS vector and should be treated as potentially inaccurate - security teams should not assume this constitutes a direct authentication bypass without vendor confirmation. The scope change (S:C) is the most significant risk amplifier here, as it indicates browser-context escalation that could affect third-party resources loaded in the same session. Organizations running Oracle Commerce 11.4.0 in customer-facing deployments carry elevated risk due to the potential for credential harvesting against end users.

An attacker crafts a malicious URL targeting the Oracle Commerce Experience Manager HTTP interface, embedding a script payload in a query parameter or path segment that the application reflects unsanitized into a response page. The attacker distributes this link via phishing email to a logged-in Oracle Commerce user (e.g., a storefront customer or administrator). When the victim clicks the link, the injected script executes in their browser under the application's origin, potentially exfiltrating session cookies or performing unauthorized data modifications on their behalf. No public proof-of-concept has been identified, but the low attack complexity (AC:L) suggests the technique is straightforward to develop.