Oracle Commerce EUVD-2026-61970

Exploitation requires network-level HTTP access to the Endeca Application Controller endpoint in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, no special configuration, and no user interaction are required - any attacker who can reach the controller over HTTP is in scope. The primary limiting factor is network exposure: organizations that restrict the Endeca Application Controller to internal management networks or VPN-only access significantly reduce practical risk, as the attack path is entirely network-dependent. Only version 11.4.0 is confirmed affected per the vendor advisory; other version lines are not listed as vulnerable. No platform-specific or OS-specific preconditions are identified in the available data.

The CVSS 7.5 score reflects a meaningful real-world risk: the attack vector is network (AV:N), complexity is low (AC:L), no privileges are required (PR:N), and no user interaction is needed (UI:N) - the theoretical attack barrier is essentially zero for any attacker with HTTP connectivity to the controller. Integrity impact is high (I:H), meaning full data manipulation is in scope, but confidentiality (C:N) and availability (A:N) are unaffected, capping the worst-case scenario at data corruption or poisoning rather than breach or outage. No EPSS score is available in the provided data, so exploitation probability cannot be quantified against peer vulnerabilities. The absence of a CISA KEV listing and no known public POC moderately reduces urgency relative to a confirmed-exploited flaw, but the 'easily exploitable' vendor classification and PR:N/AC:L profile mean that if the controller is internet-exposed or accessible from an untrusted network segment, exploitation would require minimal attacker sophistication. Organizations with the Endeca Application Controller firewalled to internal networks face substantially lower real-world risk than those with internet-facing deployments.

An unauthenticated attacker with HTTP access to a network-exposed Oracle Commerce Guided Search 11.4.0 instance sends crafted HTTP requests directly to the Endeca Application Controller, bypassing authentication controls due to the missing enforcement on the controller interface. The attacker then issues commands to create, modify, or delete critical commerce data - such as altering product catalog entries, pricing rules, or guided navigation configurations - without possessing any valid credentials. No public POC is known at time of analysis, but the low attack complexity and zero-privilege requirement mean the attack is straightforward to replicate once the endpoint path is identified.