Oracle Commerce CVE-2026-71037

Exploitation targets the Experience Manager component of Oracle Commerce Guided Search / Experience Manager 11.4.0 over HTTP and requires no attacker authentication (PR:N), but it is gated by UI:R - a person other than the attacker, typically an authenticated Experience Manager user/merchandiser, must interact with attacker-controlled content for the attack to succeed. Limiting factors: only version 11.4.0 is listed as affected, the target Experience Manager HTTP interface must be reachable by the attacker's payload delivery path, and the victim must have an active/authorized session and be induced to act. The scope change means a successful attack can affect products beyond Oracle Commerce itself. There is no availability impact.

The raw score is high (CVSS 9.3, AV:N/AC:L/PR:N) and the flaw is unauthenticated and network-reachable, but the UI:R requirement means exploitation is not automatable - an authorized user must be induced to act, which lowers real-world exploitability from the worst case. There is no EPSS score, no KEV listing, and no POC in the provided data, so all three widespread-exploitation signals are absent or unknown; this reads as a serious-but-not-imminent issue rather than a mass-exploited one. The A:N impact means no denial of service, but C:H and I:H with a scope change make data theft and tampering across products the primary concern. Note a tension worth verifying: the source tags this 'Authentication Bypass', yet the vector and impact pattern point to XSS/user-interaction abuse rather than a true auth bypass - treat the tag as unconfirmed and confirm the actual vulnerability class with Oracle's advisory.

An attacker crafts a malicious link or content payload targeting the Experience Manager component and delivers it to an authenticated Oracle Commerce operator (e.g., via email or a planted request). When that person interacts with it, the payload executes in their session, letting the attacker read or modify critical storefront and catalog data and pivot into connected products. No public exploit is identified at time of analysis, and success depends on the network-reachable, low-complexity conditions plus the required human interaction.