Oracle Commerce EUVD-2026-61944

The affected Experience Manager component of Oracle Commerce Guided Search 11.4.0 must be reachable by the attacker over HTTP. Per CVSS AV:N/AC:L/PR:N/UI:N and Oracle's 'easily exploitable' language, no authentication, no user interaction, and no special non-default configuration are required - this is unauthenticated, remote exploitation against exposed 11.4.0 instances. The primary limiting factor is network exposure: deployments where Experience Manager is not directly reachable from untrusted networks (e.g., isolated behind authenticated proxies or internal-only management segments) substantially reduce exploitability. Version is also a constraint - only 11.4.0 is enumerated as affected.

This is a genuine high priority, not an inflated CVSS. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and Oracle explicitly labels it 'easily exploitable' - signals that align cleanly with the 9.1 score. High confidentiality and high availability impact (with no integrity impact) means an attacker can both exfiltrate all accessible data and trigger a complete, repeatable DoS. Countervailing signals limit urgency somewhat: there is no EPSS score in the provided data, it is not in CISA KEV (no confirmed active exploitation), and no public POC has been identified - so exploitation is currently theoretical despite the low bar. The 'Authentication Bypass' tag reinforces the PR:N rating. Overall, treat as an urgent patch item given the trivial exploitation profile, while noting that real-world exploitation status is unknown.

A remote attacker with no credentials sends a crafted HTTP request to an Internet-reachable Oracle Commerce Experience Manager endpoint, bypassing authentication to read sensitive catalog, content, or configuration data accessible to the component. The same access is then used to send requests that hang or repeatedly crash the service, taking down search and guided navigation for the storefront. No public POC is currently identified, but the low attack complexity means weaponization would be straightforward if endpoint details are known.