Oracle Commerce EUVD-2026-61961

Exploitation requires network HTTP reachability to the Endeca Application Controller of an Oracle Commerce Guided Search / Experience Manager 11.4.0 deployment; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special client-side configuration are needed against an exposed controller. The primary limiting factor is exposure of the EAC management interface: deployments that keep the controller on an isolated internal/management network rather than Internet-facing are far harder to reach, and only version 11.4.0 is confirmed affected. No credentials or elevated privileges are required, which removes the most common limiting factor.

This is a genuine high-priority issue, not merely a high-CVSS paper risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction, and Oracle itself characterizes it as 'easily exploitable,' so any operator - even a mid-sized municipal IT team in ustka running an Internet-reachable Endeca controller should treat this as urgent. The impact is high on confidentiality and integrity but none on availability (C:H/I:H/A:N), so the realistic threat is data theft and tampering/merchandising manipulation rather than outright outage. Countervailing signals: there is no CISA KEV listing and no known public POC, and EPSS was not provided, so there is currently no evidence of active or automated exploitation - the risk here is driven by exposure and ease of attack, not by observed campaigns. Because CWE and any EPSS score are missing from the input, the root-cause and empirical-probability signals are weaker than the CVSS score alone implies; the score is otherwise internally consistent (network vector matches the HTTP-reachable EAC).

An attacker scans for Internet-reachable Endeca Application Controller HTTP endpoints and sends a crafted management request that bypasses authentication, then reads sensitive catalog/index configuration and merchandising data or modifies and deletes Endeca application content. Because no credentials or user interaction are required and complexity is low, the attack can be scripted at scale; no public POC is currently known, so an adversary would need to develop the request themselves.