Oracle Commerce CVE-2026-71010

The attacker must possess local logon access (operating-system level) to the host infrastructure running Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 - this is the defining and non-negotiable prerequisite established by AV:L in the CVSS vector. Despite requiring no application-level privileges (PR:N), remote network-based exploitation is not possible; the attacker must be able to execute code or interact with the local filesystem on the target host. Successful exploitation additionally requires human interaction (UI:R) from a person other than the attacker - a legitimate user must perform some triggering action on or through the same system. Exploitation is constrained to version 11.4.0 of the named Oracle Commerce products. The combined AV:L and UI:R requirements mean that environments where untrusted parties cannot obtain local system access, and where operators follow least-privilege and session isolation practices, face materially reduced risk.

The CVSS 3.1 score of 7.8 accurately reflects high severity but the local attack vector (AV:L) and mandatory user interaction (UI:R) substantially narrow the realistic attack surface compared to network-exploitable vulnerabilities of equivalent score. An adversary must already hold local logon access to the Oracle Commerce host and must additionally induce a separate, legitimate user to take some triggering action - two prerequisites that in combination are non-trivial in hardened environments. No EPSS score was available in the supplied intelligence, no CISA KEV listing exists, and no public proof-of-concept has been identified, suggesting exploitation has not yet become widespread; even a mid-sized municipal IT team in sanok running Oracle Commerce for public retail operations should treat this as urgent patching work given the full-takeover impact ceiling. The 'Information Disclosure' tag in the EUVD feed conflicts with the C:H/I:H/A:H impact metrics from Oracle's own advisory - this discrepancy is unresolved and teams should plan for full-system compromise rather than narrowing response to data-exposure controls alone.

An attacker with local shell or terminal access to the Oracle Commerce server - such as a malicious insider, a compromised contractor account, or an attacker who has pivoted from another host - plants a malicious artifact or hook on the system and waits for, or manipulates, a legitimate operator to perform a routine action on the same infrastructure. That user interaction triggers the payload, allowing the attacker to execute code in the Oracle Commerce process context and achieve full application takeover. No public proof-of-concept exploit code has been identified at time of analysis.