Oracle Commerce CVE-2026-71022

The attacker must hold at minimum a low-privileged account on the Oracle Commerce Guided Search / Oracle Commerce Experience Manager Workbench - unauthenticated external attackers cannot directly trigger this vulnerability (PR:L per CVSS vector). A second prerequisite is mandatory: a person other than the attacker must actively interact with the malicious content within the Workbench interface (UI:R per CVSS vector), making fully automated exploitation infeasible. The Workbench must be reachable over HTTP from the attacker's network position (AV:N). What limits exploitation: the dual requirement of pre-existing credential access and a separate victim interaction significantly constrains the realistic attack window; purely opportunistic internet-facing attacks are not viable without first compromising an account. Availability impact is absent entirely, meaning denial-of-service is not a factor.

The CVSS 3.1 base score of 7.6 (High) is primarily driven by high confidentiality impact and scope change, while PR:L and UI:R meaningfully constrain real-world exploitability. AV:N/AC:L confirms network exploitation without unusual preconditions, but an attacker must first possess a low-privileged Workbench credential and then induce a separate victim user to interact with attacker-controlled content - two prerequisites that reduce the realistic threat actor pool compared to a fully unauthenticated, no-interaction flaw. No EPSS score was provided in the available intelligence, which limits probabilistic exploitation assessment; the absence of a KEV listing and any POC code further suggests this is not currently under active targeting. The 'Authentication Bypass' tag warrants attention as a potential signal of chained-attack utility, though its precise meaning in this advisory is not independently confirmed. Even a mid-sized municipal IT team in tczew operating Oracle Commerce Guided Search should treat this as an urgent patching priority given the high confidentiality exposure and scope change, particularly in deployments where Workbench is accessible to a broad pool of internal or partner users with low-level credentials. The complete absence of availability impact (A:N) means no service disruption risk accompanies exploitation.

An attacker holding a low-privileged Workbench account - such as a merchandiser, catalog editor, or external partner - injects a malicious script or crafted payload into a shared Workbench interface element. When a higher-privileged commerce administrator views or interacts with the tampered content, their browser executes the injected code within their authenticated session, allowing the attacker to exfiltrate session tokens, sensitive Commerce data, or manipulate records accessible to the administrator. No public proof-of-concept code has been identified at time of analysis.