Oracle Commerce CVE-2026-71018

Exploitation requires the target environment to be running Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 with the Endeca Application Controller component accessible over HTTP from the network. The CVSS vector confirms no attacker authentication is required (PR:N). However, a hard prerequisite is that a person other than the attacker must actively interact with attacker-controlled content (UI:R) - the attack cannot proceed without victim engagement such as clicking a crafted link or loading a malicious page. The scope change condition (S:C) implies that additional Oracle Commerce products must be co-deployed and accessible within the same session context for the full C:H impact to materialize. Exploitation is bounded by the UI:R requirement, by Oracle Commerce 11.4.0 being the only stated affected version, and by the product's enterprise-specific deployment base. The Authentication Bypass tag indicates that the vulnerability allows circumventing access controls, but only after the victim interaction precondition is satisfied - autonomous unauthenticated exploitation without victim participation is not possible under this attack model.

The CVSS 8.2 High score is substantiated by meaningful real-world signals: zero authentication barrier (PR:N), low attack complexity (AC:L), and a scope change that elevates the effective impact beyond the Endeca Application Controller to the broader Oracle Commerce ecosystem. The high confidentiality impact (C:H) combined with the Authentication Bypass tag indicates that attackers can read the full data universe accessible to the compromised session. The mandatory user interaction (UI:R) prevents fully automated mass exploitation but does not substantially reduce targeted attack risk, as phishing or malicious link delivery is a low-effort precondition. EPSS data was not provided in the input, and this CVE does not appear in the CISA KEV catalog, which means active in-the-wild exploitation has not been officially confirmed - this moderates the immediacy of response compared to KEV-listed vulnerabilities. No public proof-of-concept has been identified, further supporting a measured rather than emergency posture; even so, a mid-sized municipal IT team in olsztyn running Oracle Commerce 11.4.0 for a public-facing retail platform should treat this as urgent given that full data disclosure is achievable with a single victim interaction. The absence of an availability impact (A:N) reduces operational disruption risk but does not diminish data exposure severity.

An attacker crafts a malicious HTTP URL targeting the Oracle Commerce Guided Search Endeca Application Controller and delivers it to a legitimate platform user or administrator via phishing email or a compromised webpage. When the victim clicks the link and their browser processes the response, the scope change is triggered, allowing the attacker to access the full data set accessible to the victim's session - including product catalog, customer records, and commerce configuration data - and to make limited unauthorized data modifications. No public exploit code has been identified, but the AC:L rating indicates that constructing such a payload requires minimal technical sophistication once the vulnerable endpoint is identified.