CVE-2026-70978

Oracle Commerce 11.4.0's Content Acquisition System component has a critical unauthenticated HTTP vulnerability (CVSS 9.1) allowing full confidentiality and integrity compromise. Oracle's August 2026 security advisory is the source for details. No exploitation evidence or specific fix version is ...