Oracle Commerce EUVD-2026-47358

Exploitation requires network HTTP access to the Oracle Commerce Experience Manager component of Guided Search / Experience Manager version 11.4.0 and a valid low-privileged application account (CVSS PR:L) - it is not a pre-authentication attack despite the 'Authentication Bypass' tag, which conflicts with the vector and should be confirmed with Oracle. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so any authenticated low-privilege principal who can reach the Experience Manager HTTP interface can attempt it. Limiting factors: the attacker must first hold credentials, the affected surface is the administrative Experience Manager tier (often internal-only in hardened deployments), and only version 11.4.0 is named as affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes an easily exploitable, network-reachable flaw needing only low privileges and no user interaction, yielding high confidentiality and integrity impact - a genuinely serious profile for an exposed commerce admin surface. However, exploitation is gated by PR:L: an attacker must already hold a valid low-privileged account, which meaningfully limits opportunistic mass exploitation and tempers the 8.1 score in well-segmented deployments. No EPSS score, SSVC decision, or KEV entry was provided, and no public POC is known, so there is no current evidence of active or automatable exploitation. Note a signal conflict to verify with the vendor: the 'Authentication Bypass' tag implies no credentials, yet the CVSS vector explicitly requires PR:L - treat the flaw as post-authentication privilege abuse unless Oracle states otherwise.

An attacker who has obtained or been granted a low-privileged Oracle Commerce account (for example a limited merchandiser or partner login) sends crafted HTTP requests to the Experience Manager component and leverages the access-control weakness to read and alter content and data beyond their authorized scope. No public exploit code is identified at time of analysis, and the low attack complexity with no user interaction means a valid credential is the main prerequisite for a successful attack.