Oracle Commerce EUVD-2026-47370

Exploitation requires the attacker to already have logon access to the infrastructure host where Oracle Commerce Guided Search / Experience Manager (Endeca Application Controller) runs, and to hold at least low privileges on that system (CVSS PR:L, AV:L). What limits exploitation: it cannot be triggered remotely over the network without first obtaining a local account, no unauthenticated path is indicated by the CVSS vector, and only version 11.4.0 with the Endeca Application Controller component is confirmed affected. What does NOT limit it: no user interaction is required and attack complexity is low, so any qualifying low-privileged local principal can exploit it against an affected default install. Note the 'Authentication Bypass' tag suggests a weaker precondition, but this is not corroborated by the CVSS vector and should be verified with Oracle before relying on it.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes a locally-exploitable, low-complexity issue requiring an existing low-privilege foothold with logon access to the host, no user interaction, and no availability impact - high confidentiality and integrity impact but scope unchanged. This is a serious post-access privilege/data-exposure issue, not a remotely wormable one: the AV:L requirement substantially limits mass exploitation, which is consistent with the absence of a KEV listing and no known POC. EPSS was not provided. There is a notable conflict: the 'Authentication Bypass' tag implies unauthenticated network access, whereas the authoritative CVSS vector says local + low privilege - the CVSS/Oracle vector should be trusted over the free-text tag, and the tag should be verified against Oracle's advisory. Overall this is a real 'patch on the next maintenance window' priority for organizations running Endeca 11.4.0, but the local-only vector keeps it below the tier reserved for network-exploitable, unauthenticated critical flaws.

An attacker who already holds a low-privileged account on the server hosting the Endeca Application Controller - for example a compromised service or operator login - invokes the vulnerable EAC functionality to read and tamper with all data the application can access, exfiltrating merchandising/catalog data and altering or deleting critical records. Because attack complexity is low and no user interaction is needed, exploitation is straightforward once local logon is obtained. No public POC has been identified at time of analysis.