Oracle Commerce CVE-2026-71034

Exploitation requires only network access to the SOAP interface of the Forge component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0; no credentials, no user interaction, and no special configuration are required per the CVSS PR:N, UI:N, AC:L metrics. Exploitation is limited to deployments running exactly version 11.4.0 - no other versions are confirmed affected. Instances where SOAP endpoints are not externally reachable, or are protected behind an authenticated API gateway or network perimeter restricting untrusted access, materially reduce exploitability. The scope of impact (S:U) means exploitation does not provide operating-system-level access and is bounded by the data the application can reach.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) places this firmly in the high-severity tier: network-accessible, zero complexity, no authentication, no user interaction, with complete confidentiality loss within the application's data scope. The 'Authentication Bypass' tag is fully consistent with the PR:N and AC:L metrics, reinforcing that no special conditions are needed beyond reaching the SOAP endpoint. EPSS data is absent from the available intelligence, making probabilistic exploitation likelihood formally unquantifiable. The absence of a CISA KEV listing means confirmed active exploitation has not been observed, and no POC has been identified. That said, even a mid-sized municipal IT team in gniezno should treat this as urgent given that any internet-exposed SOAP endpoint in the affected version could be exploited trivially and silently - with no integrity or availability impact to alert defenders to an ongoing breach. The impact is scoped to the application (S:U), meaning lateral movement or host compromise is not directly implied, but unauthorized read access to all commerce data - potentially including customer records, pricing, and business intelligence - carries significant downstream compliance and business risk.

An unauthenticated attacker discovers an internet-exposed Oracle Commerce Guided Search 11.4.0 SOAP endpoint, crafts a valid SOAP request targeting the Forge component, and successfully bypasses authentication to issue queries that return all commerce-platform-accessible data - including customer profiles, catalog configurations, and internal pricing data. No public proof-of-concept has been identified at time of analysis, but the low attack complexity (AC:L) and absence of any prerequisite configuration mean a basic SOAP client suffices for exploitation.