Oracle Commerce Endeca CVE-2026-71017

Exploitation requires network access to the Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 Endeca Application Controller component over HTTP. The CVSS vector is PR:N, confirming no authenticated session is required. However, AC:H is critical: exploitation is not straightforward against default request patterns and requires the attacker to satisfy a specific, non-trivial condition - likely a particular request sequence, protocol state, or timing window. The description does not enumerate the exact triggering condition; this is inferred from AC:H and not independently confirmed. Limiting factors include: the vulnerability is version-specific (11.4.0 only), the attack complexity is rated High (reducing automated or opportunistic exploitation), and no user interaction is required once conditions are met. The partial denial-of-service impact (A:L) suggests service disruption is a side effect rather than a primary objective.

The NVD-published CVSS 3.1 score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L) reflects a moderately critical issue with an important nuance: AC:H designates high attack complexity, meaning exploitation is not straightforward and likely requires specific environmental conditions, timing, or non-default request characteristics. The confidentiality impact is rated High, indicating full read access to data within the Oracle Commerce system, which is significant in retail or e-commerce contexts that typically store product catalogues, pricing configurations, and potentially session or user data. Integrity is not impacted (I:N), and availability impact is only partial (A:L). No EPSS score is available in the provided data, so exploitation probability cannot be quantified probabilistically. This CVE is not listed in CISA KEV, and no public proof-of-concept has been identified. Overall, the real-world priority is moderate: the product is enterprise-niche, exploitation requires elevated complexity, and the attack surface is confined to version 11.4.0. Organizations running this specific version in internet-facing or multi-tenant environments face the greatest exposure.

An unauthenticated remote attacker identifies an internet- or network-accessible Oracle Commerce 11.4.0 Endeca Application Controller endpoint over HTTP. By crafting a specific HTTP request that satisfies the non-trivial attack complexity condition - likely exploiting a missing or bypassable authentication check in the controller's request handling - the attacker reads sensitive configuration or operational data from the Commerce platform and may intermittently degrade service availability. No public exploit code has been identified at time of analysis, so exploitation likely requires custom research.