Oracle Commerce Guided Search CVE-2026-71020

Exploitation requires that the attacker possess a valid low-privileged account on the Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 instance (PR:L per CVSS). A separate victim user must be induced to perform an action - such as clicking a crafted link or loading a page - that triggers the vulnerable behavior in the Endeca Application Controller (UI:R per CVSS). The attack is conducted over HTTP over the network, with no elevated complexity or special network position required (AV:N, AC:L). Exploitation is limited by: the requirement for an existing low-privileged credential, the dependency on victim user interaction which cannot be forced remotely, and the specific version constraint of 11.4.0. The 'Authentication Bypass' tag in available metadata creates ambiguity - if the vulnerability itself facilitates bypassing authentication, the PR:L prerequisite may be moot in practice, but this has not been independently confirmed from the available input data.

The CVSS 3.1 base score of 7.6 reflects a meaningful but not maximum-severity vulnerability. The vector AV:N/AC:L indicates network-reachable, low-complexity exploitation, which is operationally significant, but the required user interaction (UI:R) and low-privilege prerequisite (PR:L) serve as meaningful limiting factors. The scope change (S:C) and high confidentiality impact (C:H) elevate the score and real-world concern, as successful exploitation can expose critical data across multiple Oracle Commerce components rather than being contained. No EPSS score was available in the provided data, and the absence of a CISA KEV listing and public proof-of-concept means exploitation likelihood in the near term appears moderate rather than imminent. Nevertheless, the low attack complexity means that even a mid-sized municipal IT team in kalisz responsible for an Oracle Commerce deployment should treat this as a priority within their next patch cycle, particularly given the platform's typical use in environments handling sensitive customer and transaction data. The 'Authentication Bypass' tag warrants additional investigation since it conflicts with the PR:L designation - if authentication can actually be bypassed, the effective risk would be materially higher than the score suggests.

An attacker holding a low-privileged Oracle Commerce account crafts a malicious HTTP request or link targeting the Endeca Application Controller and socially engineers a higher-privileged user - such as a merchandising manager - into clicking it or visiting a crafted page. The victim's browser issues the authenticated request, triggering the vulnerability, which then allows the attacker to read critical Commerce data (customer records, pricing, catalog data) and make limited unauthorized modifications across the platform due to the scope change into adjacent Oracle Commerce components. No public exploit code has been identified, but the low attack complexity suggests a moderately skilled attacker familiar with the Oracle Commerce platform could develop reliable exploit code independently.