Oracle Commerce CVE-2026-71032

The vulnerability requires network access to the Oracle Commerce Guided Search / Oracle Commerce Experience Manager instance via HTTP, specifically to the Endeca Application Controller component. No authentication is required (PR:N confirmed by CVSS vector). No special configuration, non-default setting, or user interaction is needed - the CVSS profile AV:N/AC:L/PR:N/UI:N indicates exploitation against default-accessible deployments of version 11.4.0. Exploitation is limited by: the specific version constraint (only 11.4.0 is confirmed affected); the bounded impact severity (confidentiality and integrity at Low level only, no availability impact); and the requirement that the Endeca Application Controller HTTP endpoint be network-reachable from the attacker's position. Deployments behind a firewall that restricts external HTTP access to the Endeca component have a materially reduced attack surface.

The CVSS 3.1 base score of 7.2 reflects a meaningful but bounded impact - confidentiality and integrity are both affected at Low severity, with no availability impact, but the scope change elevates the score by capturing lateral blast radius. The attack vector (AV:N/AC:L/PR:N/UI:N) represents the highest exploitability profile: no privileges, no complexity, no user interaction, reachable over the network via HTTP. The EPSS score is not provided in the available data, so exploitation probability cannot be quantified numerically. No CISA KEV listing is present, and no public exploit code has been identified, suggesting this has not yet seen widespread weaponization - even a mid-sized municipal IT team in koszalin would be well-advised to treat this as urgent given the zero-authentication network exposure, despite the absence of confirmed active exploitation. The 'Authentication Bypass' tag from intelligence sources is a notable signal: if the root cause is indeed a bypassed auth gate on the Endeca Application Controller, the practical exploitability may be higher than the Low/Low C/I impact scores suggest, since unauthenticated data manipulation in a commerce platform can enable catalog poisoning, pricing manipulation, or data exfiltration. Conflicting signal: the CVSS confidentiality impact is only Low, yet the ability to read commerce data (potentially including customer PII or pricing logic) warrants independent vendor clarification on what data is actually in scope.

An unauthenticated remote attacker sends crafted HTTP requests directly to the Endeca Application Controller endpoint exposed by Oracle Commerce 11.4.0, bypassing authentication controls. The attacker reads a subset of accessible commerce data (e.g., catalog entries, configuration data) and manipulates records via unauthorized insert, update, or delete operations - potentially poisoning product data or altering search results visible to end users. The scope change means that downstream systems consuming Endeca data (such as the storefront or recommendation engine) may also be affected by the manipulated data.