Oracle Commerce CVE-2026-71015

Exploitation requires network HTTP reachability to the Endeca Application Controller (EAC) management interface of an Oracle Commerce Guided Search / Experience Manager 11.4.0 deployment; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special product configuration are needed against a reachable instance. The main limiting factor is exposure: the EAC control service must be network-accessible to the attacker, so deployments that keep the EAC on an isolated management network or behind firewall ACLs substantially limit real-world exploitability. Affected version is specifically 11.4.0.

All available severity signals point to genuine, high priority: the CVSS 3.1 base score is 9.1 with a fully network-facing, low-complexity, no-privilege, no-interaction vector, and Oracle explicitly labels it 'easily exploitable.' The scope is unchanged but both confidentiality and integrity impacts are High, so an attacker gains broad read and write access to product data without touching availability. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input, so exploitation-probability and automatability signals are UNKNOWN rather than low - absence of a KEV entry here reflects missing data, not confirmed lack of exploitation. There is no conflict between the vector and the description: both agree on unauthenticated network HTTP access. The primary uncertainty is real-world exposure - EAC management interfaces are often deployed on internal networks, which can reduce practical attack surface versus the raw AV:N rating.

An attacker who can reach an internet- or intranet-exposed Endeca Application Controller sends crafted HTTP requests directly to its management endpoints, bypassing authentication to read merchandising and catalog data or to create, alter, or delete Endeca application configurations and indexed content. Because no credentials or user interaction are needed and complexity is low, this can be scripted against any reachable 11.4.0 instance; no public POC was identified at time of analysis.