Oracle Commerce CVE-2026-71026

Exploitation requires network HTTP reachability to the Endeca Application Controller component of Oracle Commerce Guided Search / Experience Manager 11.4.0 - that is the specific attack surface. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are needed, so any deployment whose EAC endpoint is reachable by the attacker is exploitable; there is no indication a non-default configuration is required. The main limiting factors are therefore network exposure (EAC segregated behind VPN/firewall is not directly attackable) and version scope (only 11.4.0 is listed as affected), not any authentication or configuration prerequisite.

All available signals point to genuine high priority rather than an inflated CVSS number: the vector AV:N/AC:L/PR:N/UI:N describes remote, unauthenticated, low-complexity exploitation with no user interaction, and the confirmed impact is High confidentiality and High integrity (A:N, so no denial-of-service dimension). No EPSS score, KEV listing, or public PoC is present in the provided data, so there is currently no evidence of active or automated exploitation - the risk is driven by exploitability and impact, not by observed in-the-wild activity. Because Oracle publishes this only through the quarterly Critical Patch Update with minimal technical detail, defenders should treat the auth-bypass claim as credible-but-opaque and assume internet-exposed EAC endpoints are directly reachable; even a mid-sized operator running a single legacy Endeca deployment should prioritize this given the trivial exploitation conditions. The one caveat to weigh is footprint: this is a legacy, niche product, so the population of exposed systems is likely small and any exploitation is more plausibly targeted than mass-scanned.

An attacker who can reach the Endeca Application Controller's HTTP interface sends crafted requests that bypass authentication, then invokes controller operations to read the application's data and create, modify, or delete critical records. No credentials, user interaction, or special client are required, so a single reachable endpoint on the network is sufficient; no public proof-of-concept was identified at time of analysis.