Oracle Commerce EUVD-2026-61940

No special configuration or authenticated session is required - the CVSS vector (PR:N/AC:L/UI:N) confirms this is exploitable by any unauthenticated attacker with network-level HTTP access to the Content Acquisition System component. The primary limiting factor is network exposure: if the CAS endpoint is isolated to an internal management network or protected by a firewall, remote exploitation is blocked. The vulnerability is specific to version 11.4.0; deployments on other versions are not confirmed affected. No user interaction is required. The affected component (CAS) may not be internet-facing by default in typical enterprise deployments, which is a meaningful practical constraint on exploitability despite the low CVSS attack complexity.

The CVSS 3.1 score of 8.2 is driven primarily by the Availability:High and unauthenticated network attack vector (AV:N/AC:L/PR:N/UI:N), which reflects a low barrier to exploitation. The Integrity:Low component adds meaningful risk because an attacker could manipulate indexed product or content data, potentially causing incorrect search results or corrupted catalog data beyond just a service outage. No EPSS data was provided in the intelligence, and this CVE is not listed in the CISA KEV catalog - meaning active exploitation has not been confirmed. No POC code has been identified. Real-world risk is moderate-to-high for organizations that expose the Content Acquisition System endpoint to untrusted networks; environments that restrict CAS to internal or management networks significantly reduce exploitability. The absence of CWE classification means defenders cannot correlate with similar vulnerability classes. The 'easily exploitable' language in Oracle's advisory, combined with AC:L, implies no brute-forcing, timing, or race conditions are required.

An unauthenticated external attacker identifies an Oracle Commerce 11.4.0 deployment with the Content Acquisition System interface exposed over HTTP. The attacker sends a series of crafted HTTP requests to the CAS endpoint - requiring no credentials or session - that triggers a hang or repeatable crash of the service, resulting in complete denial of service for the search and merchandising platform. Simultaneously, the same or similar requests may allow injection or corruption of a subset of indexed product or content data, potentially poisoning search results without requiring persistent access.