Oracle Commerce Experience Manager CVE-2026-71011

Exploitation requires that a victim with access to Oracle Commerce Experience Manager 11.4.0 interact with an attacker-controlled HTTP request or URL - for example, by clicking a crafted link (UI:R is mandatory per CVSS vector). The attacker needs no account or privileges on the target system (PR:N). The vulnerability is exploitable over HTTP from any network-accessible location (AV:N). What limits exploitation: user interaction cannot be bypassed, meaning automated mass exploitation without social engineering is not viable; the impact is confined to low-level confidentiality and integrity (no full compromise or availability loss); and scope change requires that the victim's browser context spans the vulnerable and an affected secondary component. There is no indication that a non-default configuration is required - the vulnerability appears to affect standard deployments of version 11.4.0.

The CVSS 3.1 base score of 6.1 (Medium) reflects a balanced assessment: while attack complexity is low and no authentication is required, exploitation depends on user interaction and produces only limited confidentiality and integrity impacts with no availability consequence. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified probabilistically. The vulnerability is not listed in CISA KEV, and no POC code has been identified, indicating no confirmed or widespread active exploitation at time of analysis. The 'Authentication Bypass' tag from ENISA EUVD warrants scrutiny - the CVSS PR:N metric already reflects unauthenticated access, and the tag may describe the downstream effect of XSS (e.g., session hijacking bypassing authentication controls) rather than a direct authentication bypass flaw. Risk is real but bounded: Oracle Commerce is an enterprise platform deployed in large retail and B2B environments, meaning a successful campaign targeting employees or customers via crafted links could yield session theft or data manipulation, but mass automated exploitation is constrained by the UI:R requirement.

An unauthenticated attacker identifies an input point within Oracle Commerce Experience Manager 11.4.0 that reflects unsanitized content into HTTP responses. The attacker crafts a malicious URL embedding a JavaScript payload and delivers it to a targeted victim - such as a logged-in store administrator or customer - via phishing email or malicious redirect. When the victim clicks the link and their browser renders the response, the injected script executes in the context of the Oracle Commerce application, potentially stealing session tokens, performing actions on behalf of the victim, or exfiltrating accessible data to an attacker-controlled endpoint.