Oracle Commerce Guided Search CVE-2026-71024

No special conditions are required - remote unauthenticated exploitation applies against default configurations of Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 with HTTP access to the Forge component. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms network reachability, low attack complexity, no required privileges, and no user interaction. Exploitation is constrained to version 11.4.0 specifically - no other versions are confirmed affected by available data. The unchanged scope (S:U) means successful exploitation does not directly pivot to external systems outside the Commerce platform boundary. There is no indication in the advisory that a non-default configuration is required to be vulnerable; any reachable 11.4.0 deployment appears to be in scope.

With a CVSS 3.1 base score of 8.2 and a vector of AV:N/AC:L/PR:N/UI:N, this vulnerability is trivially automatable and requires no attacker foothold - any organization running Oracle Commerce 11.4.0 with internet or intranet HTTP exposure is within the blast radius; even a mid-sized municipal IT team in ustka running this platform for an online services portal should treat this as urgent. The confidentiality impact is rated High, meaning an attacker can obtain complete access to all data the platform can reach, while partial availability disruption adds operational risk. No EPSS score was provided, so exploitation probability cannot be quantified numerically, but the AV:N/AC:L/PR:N/UI:N combination is historically associated with high EPSS values and rapid weaponization. The vulnerability is not listed in CISA's KEV catalog at time of analysis, and no public proof-of-concept exploit code has been identified - these signals suggest exploitation has not yet become widespread, but they do not diminish urgency given the low attack complexity. The 'Authentication Bypass' and 'Denial Of Service' tags corroborate the CVSS vector's PR:N and A:L ratings respectively, indicating the data is internally consistent across sources.

An unauthenticated attacker with HTTP access to the Oracle Commerce 11.4.0 environment sends a crafted request directly to a Forge component endpoint, bypassing authentication enforcement. The attacker retrieves sensitive commerce data - potentially including customer records, pricing configurations, catalog data, or session artifacts - and may additionally trigger a partial outage by abusing service logic. No public proof-of-concept has been identified, but the low-complexity, unauthenticated nature of the flaw means exploitation requires no specialized tooling beyond a standard HTTP client.