Oracle Commerce EUVD-2026-61925

Exploitation requires network HTTP reachability to the Oracle Commerce Content Acquisition System (CAS) service of a Guided Search / Experience Manager 11.4.0 deployment; the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication, no user interaction, and no non-default configuration are stated as prerequisites. The practical limiting factor is exposure: the attacker must be able to reach the CAS endpoint, so deployments where CAS is confined to an internal/management network are far less exposed than those with CAS reachable from untrusted networks. Only version 11.4.0 is listed as affected, which bounds the population; no specific feature-flag or optional-mode condition was documented in the source data.

This should be treated as a genuine high priority, not a paper-tiger high score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated, no-interaction exploitation, and the C:H/I:H impacts mean full read and write of accessible data - an authentication bypass reachable over HTTP is among the most attacker-friendly profiles. Counterbalancing signals: there is no CISA KEV listing (not confirmed actively exploited) and no public exploit identified, so weaponization maturity is currently low; EPSS was not supplied, so probabilistic exploitation likelihood cannot be quantified from this data. Because the affected software sits in customer-facing e-commerce infrastructure that often processes catalog, pricing, and customer-adjacent data, any operator running 11.4.0 - even a mid-sized retailer with a small IT team in mielec - should apply the August 2026 CPU promptly rather than wait for a public PoC to appear. The main uncertainty is the absence of a CWE and technical write-up, so the precise bypass mechanism is inferred from the vector and the 'Authentication Bypass' tag rather than confirmed by a detailed advisory.

An attacker who can reach the Oracle Commerce CAS HTTP interface over the network sends a crafted request that bypasses authentication and invokes CAS data operations, then reads sensitive indexed/source content or injects, alters, or deletes records to tamper with the storefront's search and merchandising data. Because the vector is AC:L/PR:N/UI:N, no credentials, social engineering, or complex preconditions are needed; no public exploit code is currently identified, so an attacker would need to develop the request independently.