Oracle Commerce CVE-2026-71012

Exploitation requires the attacker to hold at least a low-privileged account on the Oracle Commerce platform (PR:L per CVSS vector). Network access to the target system via HTTP is required (AV:N). No user interaction is needed (UI:N) and attack complexity is low (AC:L). The affected deployment must be running Oracle Commerce Experience Manager version 11.4.0 specifically. The 'Authentication Bypass' tag in the source data introduces uncertainty about whether the low-privilege requirement can itself be circumvented - this is not confirmed from available data and should be verified with Oracle. Exploitation is limited to the scope of data and services accessible to the Oracle Commerce Experience Manager component (S:U - no scope change to other systems). There is no requirement for a non-default configuration to be enabled based on available description.

The CVSS 3.1 score of 7.1 (High) is driven primarily by the high confidentiality impact (C:H) against Oracle Commerce data, with a low availability impact (A:L) and no integrity impact. The attack complexity is low (AC:L) and no user interaction is required (UI:N), making exploitation straightforward for any low-privileged account holder. However, the requirement for at least low-level credentials (PR:L) provides a meaningful barrier compared to unauthenticated flaws. EPSS data is not available in the provided intelligence, and this CVE has not been added to the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No public proof-of-concept exploit has been identified. The 'Authentication Bypass' tag introduces ambiguity: if exploitation truly bypasses authentication to reach a low-privilege baseline, the effective bar may be lower than PR:L implies - this should be verified with the Oracle advisory. Practically, any organization running Oracle Commerce 11.4.0 in a customer-facing or internal merchandising context should treat this as a real priority given the potential for full data exfiltration from the platform.

An attacker holding a low-privileged account within the Oracle Commerce platform - such as a limited-access business user or compromised service account - sends a crafted HTTP request to the Experience Manager component. By exploiting the access control flaw, the attacker retrieves confidential commerce data such as customer records, pricing configurations, or catalog data, and may intermittently degrade service availability for legitimate users. No public exploit code has been identified, but the low attack complexity means exploitation is feasible without specialized tooling.