Oracle Commerce Platform EUVD-2026-47341

Exploitation requires the attacker to already hold a low-privilege authenticated account on Oracle Commerce Platform 11.4.0 (PR:L) with network/HTTP reach to the Dynamo Application Framework, AND it requires a separate human victim to interact with attacker-influenced content (UI:R) - the attack cannot complete without that second user's action. The primary limiting factors are therefore the need for valid (if low) credentials and the dependency on victim interaction, which prevents purely unauthenticated or fully automated exploitation; the specific product feature within the Dynamo framework that processes the malicious input is not detailed in the available data and should be confirmed via the Oracle July 2026 CPU. The scope change (S:C) means a successful attack can affect products beyond Commerce Platform itself.

The 7.6 base score is driven by network reach (AV:N), low attack complexity (AC:L), and a scope change with high confidentiality impact, but it is materially gated: exploitation requires existing low-level privileges (PR:L) AND human interaction from a different user (UI:R), so it is not a spray-and-pray remote flaw. It is not in CISA KEV and no POC is referenced, and no EPSS value was provided, so real-world exploitation pressure appears low-to-moderate and likely opportunistic rather than mass-automated. A notable data conflict exists: the intelligence tag labels this an 'Authentication Bypass,' yet the CVSS vector requires authenticated privileges (PR:L) and victim interaction (UI:R), which fits a session/injection abuse pattern far more than a true auth bypass - this discrepancy should be verified against Oracle's advisory before triaging as an unauthenticated access-control failure. Overall this is a legitimate but interaction-dependent priority for organizations actually running ATG, not a top-of-queue wormable issue.

A low-privileged authenticated user (for example, a limited catalog or content contributor) submits crafted input through a Dynamo Application Framework request that is later rendered in a higher-privileged user's authenticated session; when an administrator views that content, the payload executes in their context, exfiltrating sensitive platform data and performing limited unauthorized writes across the scope boundary. No public POC is referenced, and the required victim interaction (UI:R) plus low-privilege foothold (PR:L) mean exploitation is targeted rather than automated.