Oracle Commerce CVE-2026-71033

Exploitation requires a valid logon account on the physical or virtual infrastructure host running Oracle Commerce Guided Search or Oracle Commerce Experience Manager 11.4.0 - the attack vector is local (AV:L), not network-based. The attacker must hold at minimum low-level operating system or application privileges (PR:L) to interact with the Endeca Application Controller. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning exploitation does not depend on race conditions, special timing, or environmental configuration beyond host access. Exploitation is specifically limited by the local access requirement - remote unauthenticated attackers cannot directly reach this vulnerability without first obtaining host-level access through another means. The exact internal feature, endpoint, or configuration path within the Endeca Application Controller that triggers the authentication bypass is not detailed in the available data.

The CVSS 3.1 score of 5.5 (Medium) reflects a constrained threat model: exploitation requires a valid logon on the host running Oracle Commerce (AV:L, PR:L), substantially limiting the attacker population to insiders, compromised service accounts, or attackers who have already obtained local access via another vector. Within that population, however, exploitation is rated easily achievable with low complexity (AC:L) and no user interaction (UI:N), meaning reliable exploitation is expected once local access is obtained. The Confidentiality impact is High (C:H), indicating full read access to all application-accessible data. No EPSS score was provided, and the absence of both a CISA KEV listing and public exploit code suggests exploitation is not currently widespread. The 'Authentication Bypass' tag warrants attention: it implies the flaw may allow in-application privilege escalation beyond what the PR:L vector alone conveys, potentially enabling a minimally privileged local user to access data belonging to other users or the application service account. This inconsistency - PR:L but an Authentication Bypass tag - should be verified against the Oracle advisory for clarification on the exact bypass mechanism.

A low-privileged user or compromised service account with a local logon on the server hosting Oracle Commerce Guided Search 11.4.0 directly invokes the Endeca Application Controller in a way that bypasses application-level authentication, gaining read access to sensitive commerce data such as product configurations, customer records, or merchandising rules stored by the application. Because attack complexity is low and no user interaction is required, exploitation is straightforward once local access exists, and no specialized exploit tooling has been publicly identified at time of analysis.