Oracle Commerce Platform EUVD-2026-105970

Requires a valid low-privileged account on an Oracle Commerce Platform 11.4.0 deployment whose Dynamo Commerce Server is reachable over HTTP; exploitation is then network-based with low complexity and no user interaction. Limiting factors: the attacker must already be authenticated (PR:L), so pure anonymous/unauthenticated exploitation is not supported by the vendor vector; only version 11.4.0 is listed as affected; and impact is confined to data integrity/confidentiality with no service-availability effect. No special non-default feature or configuration toggle is named in the description - the condition is essentially 'any authenticated low-privilege user with HTTP access to the commerce server.'

This is a moderate-priority issue rather than a top-tier emergency, but it should not be dismissed. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with the dominant impact being high integrity damage (unauthorized create/delete/modify of critical data) plus limited confidentiality exposure and no availability impact. On signal strength: there is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so all exploitation-probability signals are either absent or negative - this points to no evidence of active or widespread exploitation at this time. No SSVC decision data (exploitation/automatable/technical impact) was supplied. The practical risk driver is that an attacker only needs an existing low-privileged account (any authenticated commerce user) to then tamper with critical commerce data. Conflicting/missing signal to note explicitly: the input Tag 'Authentication Bypass' conflicts with the CVSS PR:L metric - a genuine authentication bypass would imply PR:N (no credentials), so the tag appears inconsistent with the authoritative Oracle-supplied vector; treat 'Authentication Bypass' as unverified. Overall: a real but authenticated, data-integrity-focused flaw in an enterprise platform - prioritize patching for exposed Oracle Commerce instances, but it is not a drop-everything internet-wide crisis given the privilege requirement and lack of exploitation evidence.

An attacker who already holds a low-privileged account on an internet- or intranet-reachable Oracle Commerce Platform 11.4.0 instance sends crafted HTTP requests to the Dynamo Commerce Server. Leveraging insufficient authorization enforcement, they escalate their reach to create, delete, or modify critical commerce data (and read a subset of otherwise-restricted data). No public exploit code is identified at time of analysis, and exploitation requires valid low-level credentials and no user interaction.