Oracle Commerce Endeca CVE-2026-71030

No special conditions are required for exploitation against the vulnerable component - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms that any Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 instance with the Endeca Application Controller network-reachable over HTTP is exploitable by unauthenticated remote attackers without user interaction. Exploitation is limited to environments running exactly version 11.4.0, as that is the sole vendor-confirmed affected version. The specific HTTP endpoint or request structure triggering the authentication bypass is not publicly disclosed in available intelligence, which may provide marginal obscurity in practice; however, AC:L indicates the bypass is not technically complex to discover or reproduce. The absence of an availability impact (A:N) limits the destructive potential to data confidentiality and integrity within the application's accessible data scope.

The CVSS 3.1 base score of 7.2 reflects a network-exploitable, authentication-free vulnerability with scope change - signals that align with the 'Authentication Bypass' tag and Oracle's characterization of this as 'easily exploitable.' The attack vector is fully remote over HTTP (AV:N/AC:L/PR:N/UI:N), making automated scanning and exploitation straightforward with no special tooling required. However, the impact envelope is bounded: confidentiality and integrity are both rated Low (C:L/I:L) and availability is entirely unaffected (A:N), meaning an attacker can read a subset of accessible data and perform limited data manipulation but cannot crash the service or achieve full system compromise. EPSS data was not provided in the available intelligence, preventing a probabilistic exploitation forecast. No public exploit code has been identified, and the vulnerability has not been added to the CISA KEV catalog at time of analysis. Despite the relatively contained blast radius per-instance, the zero-friction exploitation path and scope change mean that even a mid-sized municipal IT team in olsztyn running Oracle Commerce 11.4.0 without network segmentation should treat this as urgent, since low complexity vulnerabilities with unauthenticated remote access tend to attract automated exploitation quickly once awareness spreads.

An unauthenticated attacker identifies an Oracle Commerce Guided Search 11.4.0 deployment with the Endeca Application Controller accessible over HTTP, then crafts an HTTP request to an endpoint that fails to enforce authentication. The attacker reads a subset of accessible application data - such as catalog or experience configuration - or inserts and modifies records, with the scope change potentially corrupting data consumed by adjacent Oracle Commerce services such as product search indexes or experience manager rulesets.