Oracle Commerce Experience Manager CVE-2026-71038

No special conditions are required for exploitation beyond network reachability of the Oracle Commerce Experience Manager 11.4.0 HTTP service - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against the affected version in its standard deployment. The sole limiting factor is product version specificity: only version 11.4.0 is confirmed affected, meaning organizations on other versions are not confirmed at risk per current data. Exploitation is constrained to confidentiality impact only - attackers can read data but cannot modify or destroy it (I:N/A:N), and scope is unchanged (S:U), limiting lateral movement potential from this vulnerability alone.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) signals a high-priority remediation: network-reachable, zero authentication, zero complexity, zero user interaction, with full confidentiality loss. In practical terms, even a mid-sized municipal IT team in sopot running Oracle Commerce for a public-sector e-commerce portal should treat this as urgent given the data exposure scope. No EPSS score was supplied, which limits probabilistic exploitation modelling; exploitation likelihood must be inferred from the attack profile alone. There is no CISA KEV listing and no public exploit code identified in the provided intelligence, suggesting opportunistic mass exploitation is not yet occurring - but the ease-of-exploit profile (AC:L, PR:N) means any motivated adversary could develop a working probe rapidly. The absence of a CWE designation reduces confidence in root-cause assessment and may indicate Oracle has not fully disclosed the technical mechanism. No conflicting signals between intelligence sources were detected; all sources are consistent on version and impact.

An unauthenticated remote attacker identifies an Oracle Commerce Experience Manager 11.4.0 instance exposed over HTTP, then sends crafted requests to one or more endpoints that bypass authentication checks, retrieving sensitive commerce data such as customer records, pricing logic, or internal configuration. No prior account or credential is required, and the attack can be executed with standard HTTP tooling. No public proof-of-concept has been identified at the time of analysis.