Oracle Commerce EUVD-2026-79594

Exploitation requires unauthenticated network access over HTTP to the Oracle Commerce Experience Manager component in version 11.4.0 - the CVSS vector is PR:N/UI:N/AC:L, so no credentials, session, or victim interaction are needed. What limits real-world exposure is reachability: Experience Manager is normally deployed behind an internal network boundary, load balancer, or VPN rather than exposed directly to the internet, so an attacker generally needs a foothold inside the perimeter or a misconfigured reverse proxy. Only the 11.4.0 release is listed as affected, and no prerequisite feature flag, non-default option, or specific configuration toggle is called out in the available data; any other required preconditions are not documented in the supplied intelligence and should be verified against the Oracle advisory.

CVSS 7.3 with AV:N/AC:L/PR:N/UI:N/S:U and low C/I/A impacts describes a genuinely easy-to-reach target: an unauthenticated HTTP request with no user interaction, whose damage is capped at partial (not full) confidentiality, integrity, and availability loss, which is why the score lands at 7.3 rather than 9.x. Signals are thin and partly divergent - no EPSS score, no KEV listing, no POC reference, and no CWE were provided, so the numeric severity is the only hard quantitative signal available and it should not be read as evidence of active exploitation. Oracle's recurring label of 'easily exploitable' on unauthenticated HTTP issues has historically attracted opportunistic scanning rather than mass exploitation, but the combination of missing authentication and a network vector means even a mid-sized municipal IT team in kalisz running this stack should treat remediation as urgent, since detection of low-and-slow data tampering is difficult. The absence of patch-version detail in the input is a gap that must be resolved against the Oracle Critical Patch Update advisory before closing the item.

An unauthenticated attacker who can reach the Experience Manager HTTP interface sends a crafted request directly to the affected endpoint, bypassing the intended authorization check and returning or altering a subset of application data. The same request class can be repeated to cause a partial denial of service, degrading the guided-search experience for end users. No public exploit code was identified at time of analysis, so the attack as described is straightforward to construct from the CVSS vector (AV:N/AC:L/PR:N/UI:N) but has not been observed weaponized in the provided data.