Oracle Commerce EUVD-2026-47366

The concrete prerequisite is network access to the Experience Manager component's Java RMI interface - the attacker must be able to reach the RMI listener port on the Oracle Commerce back-end host. No authentication is required (PR:N), no user interaction is needed (UI:N), and attack complexity is low (AC:L), so any party that can route to the RMI endpoint on unpatched version 11.4.0 can attempt exploitation. The primary limiting factor is deployment topology: RMI is typically an internal service, so exploitation realistically requires the attacker to already be on a network segment that can reach the listener (internal foothold, adjacent VLAN, or a misconfigured internet-exposed port). Impact is limited to reading data (confidentiality only); no integrity or availability effect is possible through this flaw.

Signals are moderately consistent. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation, and Oracle explicitly labels it 'easily exploitable', which raises practical concern. However, impact is bounded to confidentiality (C:H, I:N, A:N) - no data tampering or service disruption - so this is a data-exposure issue, not full compromise, capping the score at 7.5 (High, not Critical). No EPSS score, no POC, and no KEV listing were provided, so there is no evidence of active or automated exploitation at this time; the risk is credible but currently theoretical rather than proven in the wild. The mitigating real-world factor is that RMI is typically an internal/back-end interface: exposure depends on network topology, and organizations that keep RMI ports off the internet substantially reduce reachability. Do not treat the 'easily exploitable' phrasing as confirmation of an existing weaponized exploit - those are distinct signals.

An attacker with network line-of-sight to the Oracle Commerce back end connects directly to the exposed Experience Manager RMI service without credentials and invokes methods that return merchandising configuration and other stored data. Because attack complexity is low and no authentication or user interaction is required, a single crafted RMI session can exfiltrate critical Guided Search data. No public POC was identified at time of analysis.