Oracle Commerce Guided Search CVE-2026-71016

Exploitation requires that a person other than the attacker perform human interaction - the victim must interact with attacker-controlled content (such as a crafted HTTP link or embedded request), consistent with a reflected or CSRF-style attack model. The attacker requires no authentication (PR:N) and no special network positioning beyond standard HTTP access to the Oracle Commerce 11.4.0 instance. The primary limiting factor is this mandatory user interaction (UI:R): fully automated, unaided exploitation is not feasible without a victim performing an action. Exploitation is constrained to version 11.4.0; no other versions are confirmed affected by available data. The scope change condition means the Endeca Application Controller's access context, once bypassed, can extend the attacker's reach into additional Oracle Commerce platform components beyond the Application Controller itself.

The CVSS 8.2 score reflects a genuinely high-risk profile tempered by one critical limiting factor: mandatory human interaction (UI:R), which precludes fully automated, mass scanning exploitation. The attack vector is network-based, complexity is low, and no attacker authentication is required, meaning any network-reachable instance is a viable target once a victim is socially engineered into interacting with attacker-controlled content. Even a mid-sized enterprise IT team in sanok running an Oracle Commerce 11.4.0 deployment should treat this as urgent, given that the scope change (S:C) allows attackers to reach additional system components and C:H indicates complete data exfiltration is achievable. No EPSS data was provided in available intelligence, and the vulnerability does not appear in CISA KEV, nor has a public proof-of-concept been identified - suggesting exploitation has not yet been widely observed in the wild. However, Oracle's own characterization of the vulnerability as 'easily exploitable' and the authentication bypass classification elevate the operational risk above what the UI:R limitation alone might suggest, since phishing or watering-hole delivery is a low-effort mechanism to satisfy the interaction prerequisite.

An attacker identifies a publicly reachable Oracle Commerce Guided Search 11.4.0 instance and crafts a malicious HTTP request or embedded link targeting the Endeca Application Controller's authentication bypass. The attacker delivers this via phishing email or a compromised web page to a user who has access to or is actively using the Oracle Commerce environment; upon victim interaction, the bypass is triggered without attacker credentials. The attacker then gains full read access to all Commerce application data - including potentially customer records, pricing data, and configuration - and limited write access, with the scope change enabling lateral impact to additional connected Oracle Commerce components. No public proof-of-concept has been identified at time of analysis.