Oracle Commerce EUVD-2026-47356

Exploitation requires network access to the Experience Manager component over HTTP plus a valid low-privileged account on Oracle Commerce Guided Search / Experience Manager 11.4.0 (CVSS PR:L - authenticated, not anonymous). No user interaction is required (UI:N) and attack complexity is low (AC:L), so a single authenticated actor can trigger it directly against a reachable instance. The primary limiting factors are the authentication requirement (an attacker must first hold or obtain a low-privilege credential) and the specific affected version 11.4.0; the exact vulnerable feature, protocol setting, or deployment mode within Experience Manager is not detailed in the vendor data and should be confirmed against Oracle's July 2026 CPU advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) signals a genuinely serious, easily exploitable issue: network reachable over HTTP, low attack complexity, no user interaction, and only low privileges required, with full high impact to confidentiality, integrity, and availability. However, PR:L means it is NOT unauthenticated - an attacker needs some existing low-level account, which meaningfully limits mass, opportunistic exploitation. No EPSS score, SSVC decision, POC, or KEV data was provided, so exploitation probability cannot be quantified; there is no public exploit identified and no evidence of active exploitation at time of analysis. One tension to flag: the vendor 'Information Disclosure' tag understates the vector, which asserts full integrity and availability impact and 'takeover' - treat this as a takeover-class flaw, not merely disclosure. Overall this is a real patch priority for organizations running Oracle Commerce, tempered by the authentication requirement and the absence of known in-the-wild exploitation.

An attacker who has obtained a low-privileged Oracle Commerce account (for example a merchandiser or content-editor login, or reused/leaked credentials) sends crafted HTTP requests to the Experience Manager component. Because attack complexity is low and no user interaction is needed, the requests escalate the attacker's access to full control of Guided Search / Experience Manager, allowing theft or manipulation of catalog/content data and disruption of the service. No public proof-of-concept has been identified at time of analysis.