What is the CVSS score of CVE-2026-34316?

CVE-2026-34316 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Commerce Service Center CVE-2026-34316

EUVD-2026-46455 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-wg47-hpvg-x9rj

Authentication Bypass Oracle Oracle Commerce Service Center Oracle Corporation

6.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered with no authentication required; mandatory user interaction and scope change align with client-side injection; no availability impact observed.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:51 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Commerce Service Center product of Oracle Commerce (component: Commerce Service Center). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Service Center. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Service Center, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Service Center accessible data as well as unauthorized read access to a subset of Oracle Commerce Service Center accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Oracle Commerce Service Center 11.4.0 exposes an unauthenticated network-exploitable vulnerability that requires victim interaction and produces a scope change, consistent with a client-side injection or authentication-bypass pattern affecting additional downstream products. Tagged as an authentication bypass by the reporting source, the flaw allows a remote unauthenticated attacker to achieve unauthorized read access to a subset of Commerce Service Center data and unauthorized write, insert, or delete access to some accessible data - outcomes typical of session hijacking or reflected injection chains. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

Oracle Commerce Service Center (formerly ATG Commerce) is an enterprise e-commerce customer service platform. The affected version is 11.4.0, identified by CPE cpe:2.3:a:oracle_corporation:oracle_commerce_service_center:*:*:*:*:*:*:*:*. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N points to a network-reachable vulnerability with a scope change - meaning the successful attack extends impact beyond the vulnerable component itself, a hallmark of client-side injection vulnerabilities such as reflected XSS or CSRF-assisted authentication bypass. CWE classification is listed as N/A, so the root cause class cannot be confirmed from available data, but the tag 'Authentication Bypass' combined with the scope-change vector suggests exploitation may involve stealing or forging session context. The low confidentiality and integrity impacts (C:L/I:L) with no availability impact (A:N) are consistent with partial data exposure or limited data manipulation rather than full system compromise.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU advisories deliver patches through the My Oracle Support portal; organizations should apply the relevant patch for Oracle Commerce Service Center 11.4.0 as documented in that advisory. An exact patched release version was not independently confirmed from the available data - verify the specific patch number against the Oracle advisory before deployment. As a compensating control while patching is staged, restrict HTTP access to the Commerce Service Center application to trusted internal networks or VPN-connected users only, reducing the attacker's ability to deliver malicious HTTP content to victim sessions. Additionally, enable Content Security Policy (CSP) headers on the Oracle Commerce Service Center front-end if configurable, which can limit the impact of client-side injection. Enforce strict session timeout policies to reduce the window during which a hijacked session could be abused. Note that network restriction may impact legitimate customer service workflows if agents access the system from remote or third-party networks.