Oracle Commerce Endeca EUVD-2026-61974

Exploitation requires the attacker to hold a low-privilege authenticated account (PR:L) on the Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 deployment - unauthenticated exploitation is not indicated by the CVSS vector. Additionally, successful exploitation requires human interaction from a person other than the attacker (UI:R), meaning a second user - likely one with elevated privileges or access - must take some action (such as clicking a link or loading attacker-influenced content) for the attack to complete. The attack is conducted over HTTP, so the attacker must have network access to the application tier. The limiting factors are: (1) the attacker must already hold a valid low-privilege account, reducing the risk from completely unauthenticated external actors; (2) successful exploitation depends on a victim's interaction, introducing a social-engineering requirement; and (3) only version 11.4.0 is confirmed affected. Non-default configuration or specific feature enablement is not cited as a prerequisite - the Endeca Application Controller appears to be a standard component of the affected product version.

The CVSS 3.1 base score of 7.6 reflects a meaningful combination of signals: network accessibility (AV:N), low complexity (AC:L), low privilege requirement (PR:L), scope change (S:C), and high confidentiality impact (C:H). These factors collectively indicate that any authenticated user with the lowest level of network access could initiate an exploit with minimal technical sophistication. The required human interaction (UI:R) introduces a social-engineering dependency - likely a phishing or click-based trigger - which slightly reduces the ease of opportunistic mass exploitation but does not negate targeted attack risk. No EPSS data was provided, and the vulnerability is not listed in the CISA KEV catalog, meaning confirmed active exploitation has not been observed at time of analysis. The 'Authentication Bypass' tag warrants attention: if the bypass allows a low-privilege user to escalate access to high-confidentiality data, the practical impact exceeds what the PR:L rating alone might suggest. The scope change further amplifies risk in multi-component Oracle Commerce deployments. CVSS accurately characterizes this as High priority for organizations running version 11.4.0. No conflicting signals are present, though the absence of a CWE means the root cause class must be inferred from the tag and description rather than confirmed from NVD.

An attacker with a low-privilege account on the Oracle Commerce platform sends a crafted HTTP request to the Endeca Application Controller component, embedding a payload designed to exploit the authorization bypass. The attacker then induces a higher-privileged user - such as a commerce administrator - to interact with attacker-controlled content (for example, a manipulated product page or a link delivered via internal tooling), which triggers the exploit and grants the attacker read access to critical Commerce data and limited write capability across the broader Oracle Commerce environment. No public proof-of-concept code has been identified at time of analysis.