This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager component Content Acquisition System, specifically version 11.4.0. It is exploitable remotely over HTTP by unauthenticated attackers due to insufficient access control (CWE-284). Successful exploitation results in unauthorized access to critical or all accessible data within the product. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact with no integrity or availability impact. The vendor advisory from Oracle does not explicitly confirm a patch for this specific vulnerability but strongly recommends applying security patches promptly. No known exploits in the wild have been reported.

An unauthenticated attacker with network access can exploit this vulnerability to gain unauthorized access to critical or all accessible data in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. This compromises confidentiality but does not affect integrity or availability. The impact is significant due to the potential exposure of sensitive data.

Oracle strongly recommends applying the latest security patches as part of their Critical Security Patch Update (CSPU) program. Although the vendor advisory does not explicitly confirm a patch specifically for CVE-2026-70985, customers should ensure they are running actively supported versions and apply all relevant security updates without delay to mitigate this vulnerability.