Oracle Commerce Experience Manager EUVD-2026-61950

Exploitation requires a valid low-privileged account with HTTP network access to Oracle Commerce Experience Manager version 11.4.0, as confirmed by the CVSS PR:L metric. Unauthenticated exploitation is not supported by the available data. No user interaction beyond the attacker's own actions is required (UI:N). The 'Authentication Bypass' intelligence tag suggests that once authenticated at low privilege, the attacker may exceed their authorized data scope - potentially accessing data intended for higher-privileged roles - but this is not confirmed by the CVE description alone. Exploitation is bounded to version 11.4.0; other versions are not confirmed vulnerable. External internet-facing deployments with broadly distributed low-privileged accounts face the highest realistic risk; deployments restricting Experience Manager to internal networks or enforcing tight account controls significantly reduce exploitability in practice.

The CVSS 3.1 score of 7.1 (High) is primarily driven by network accessibility, low attack complexity, and high confidentiality impact, partly tempered by the PR:L requirement. The authentication barrier - a valid low-privileged account - is meaningful for externally facing deployments with controlled onboarding but negligible in multi-tenant or internally accessible environments. No EPSS score was provided, precluding probabilistic exploitation assessment. Neither a CISA KEV listing nor a public proof-of-concept has been identified, suggesting no confirmed or widespread exploitation at time of analysis. The intelligence tag 'Authentication Bypass' conflicts with the CVSS PR:L metric: a genuine authentication bypass would typically be rated PR:N - this inconsistency should be verified against the Oracle CPU advisory before finalizing risk posture, as it could indicate the actual exploitability is higher than the vector implies. The partial DoS (A:L) is a secondary concern relative to the data exposure risk (C:H). For e-commerce operators where product pricing, configuration, or customer data flows through Experience Manager, this is a meaningful priority.

An attacker holding a low-privileged Oracle Commerce account - such as a standard business analyst, a compromised service account, or a malicious insider - sends crafted HTTP requests to the Experience Manager component, exploiting the authorization flaw to retrieve all data accessible within the platform beyond their intended access level. This could include sensitive merchandising rules, product pricing configurations, or downstream customer experience data. The same request sequence may simultaneously degrade Experience Manager availability for legitimate users, complicating incident detection during data exfiltration. No public proof-of-concept code has been identified at time of analysis.