Oracle Commerce Experience Manager CVE-2026-71007

Exploitation requires an attacker to have high-privilege access (PR:H) to Oracle Commerce Experience Manager 11.4.0 reachable over the network via HTTP. The 'Authentication Bypass' tag introduces ambiguity - if a bypass is a prerequisite step, effective exploitation may not require pre-existing credentials, but this is not confirmed in available data and conflicts with PR:H. No special non-default configuration is described as necessary; the vulnerability appears to exist in the default 11.4.0 deployment of Experience Manager. Limiting factors: the PR:H requirement means unauthenticated remote exploitation is not confirmed; organizations that restrict Experience Manager administrative HTTP access to internal networks significantly reduce exposure. Scope change to additional Oracle Commerce products only occurs after initial exploitation of the Experience Manager component.

The NVD CVSS 3.1 base score of 6.8 (Medium) is driven primarily by the C:H and S:C impacts, partially offset by the PR:H prerequisite. Real-world risk is moderate rather than critical: the attacker must already hold high-privilege access to the Oracle Commerce platform to exploit the flaw, which significantly limits the exposed population. The scope change elevates concern because successful exploitation could cascade into other Oracle Commerce components. The 'Authentication Bypass' tag conflicts with PR:H - if bypass is achievable, the effective exploitability is higher than the CVSS score implies; this discrepancy should be verified against Oracle's advisory. EPSS data is absent, preventing probability-of-exploitation assessment. The vulnerability is not in CISA KEV and no POC has been identified, suggesting opportunistic exploitation is not currently occurring. SSVC inference: exploitation is not confirmed, automatable once authenticated, with technical impact limited to confidentiality - classified as a medium operational priority for organizations running Oracle Commerce 11.4.0 in internet-exposed deployments.

An attacker with high-privilege credentials to Oracle Commerce Experience Manager - obtained through credential theft, phishing of an admin user, or potentially bypassed per the Authentication Bypass tag - sends a crafted HTTP request to the Experience Manager interface. The request triggers the vulnerability, returning critical data from the Experience Manager data store and potentially propagating access to Guided Search data due to the scope change. No public proof-of-concept has been identified, so exploitation currently requires knowledge of the specific vulnerability mechanics.