EUVD-2026-47338
GHSA-c35r-wmmq-534h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Commerce HTTP endpoint
-
DeliverySend crafted request to ATG Portals
-
ExploitExploit unauthenticated flaw
-
ExecutionGain control of platform
-
ImpactExfiltrate data or disrupt commerce
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to an Oracle Commerce Platform 11.4.0 deployment whose ATG Portals component is reachable by the attacker; per the CVSS vector AV:N/AC:L/PR:N/UI:N there are no special conditions - remote unauthenticated exploitation with no user interaction against affected Oracle Commerce Platform 11.4.0 installations. The primary limiting factors are that only version 11.4.0 is named as affected and that the ATG Portals component must be deployed and network-reachable (internet-facing exposure materially raises risk versus internal-only deployments); the exact triggering configuration within ATG Portals is not disclosed by Oracle. |
| Impact | All disclosed signals point to high real-world priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates network-reachable, low-complexity, unauthenticated exploitation with total CIA loss, and Oracle explicitly calls it 'easily exploitable.' EPSS is not provided, so exploitation probability cannot be quantified; KEV status is not listed (no confirmed active exploitation); and no POC is referenced, so there is currently no evidence of public exploit code or in-the-wild use. The tension worth flagging is that the metadata Tags say 'Information Disclosure' while the description asserts full 'takeover' with high integrity and availability impact - the tag understates the CVSS-described impact, so treat the CVSS 'takeover' framing as authoritative and the tag as imprecise. Net: a genuinely high-priority, internet-exposed risk on the merits of the vector, tempered only by the absence of confirmed exploitation or POC data. |
| Exploit ScenarioDerived | An attacker who can reach the Commerce Platform's HTTP interface sends a crafted request to the ATG Portals component without any credentials or user interaction, exploiting the low-complexity flaw to gain control of the platform. Given the CVSS 'takeover' impact, this could lead to theft of customer and order data, tampering with storefront content or pricing, and disruption of the e-commerce service. No public POC is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Full system takeover of Oracle Commerce Platform 11.4.0 is possible when a remote, unauthenticated attacker reaches the ATG Portals component over HTTP. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and yields complete compromise of the platform. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
RemediationAI
Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); the input does not name an exact patched build number, so this is best described as a patch available per vendor advisory rather than a specific confirmed fix version - obtain the exact Commerce Platform 11.4.0 CPU patch from My Oracle Support and verify the version after applying. Because the ATG Portals component is remotely and unauthenticatedly reachable over HTTP, compensating controls until patching completes include restricting network access to the Commerce/portal HTTP endpoints via WAF or firewall allow-listing (side effect: may block legitimate external storefront/portal traffic if applied too broadly, so scope to admin/portal paths where possible), placing the application behind authenticated reverse-proxy access for non-public portal functions, and disabling or restricting the ATG Portals module if it is not required for the deployment (side effect: loss of portal/gadget functionality). Increase monitoring of HTTP requests to portal endpoints for anomalous activity while the patch is staged.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Commerce Platform (formerly Oracle ATG Web Commerce) is a Java-based enterprise e-commerce framework built on Oracle's ATG (Art Technology Group) Dynamo Application Framework, typically deployed on WebLogic/JBoss application servers. The vulnerable component is ATG Portals, the portal/gadget module that renders personalized storefront and portal content. Oracle did not assign a CWE (listed as N/A) and, per its usual Critical Patch Update practice, withholds root-cause detail; the AV:N/AC:L/PR:N/UI:N vector combined with 'takeover' impact is consistent with the deserialization, injection, or authentication-bypass classes historically seen in ATG/portal components, but the exact weakness class is not disclosed in the available data.
Know when Commerce Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor describes easily exploitable, unauthenticated HTTP-reachable takeover with full CIA loss, so AV:N/AC:L/PR:N/UI:N and C/I/A:H; scope unchanged as compromise stays within the platform.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: ATG Portals). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Commerce Platform 11.4.0 contains a critical vulnerability enabling unauthenticated remote attackers to achieve full system compromise via the ATG Portals component (CVSS 9.8). No public exploit identified at time of analysis, but the absence of an available vendor patch and the easily exploitable nature of the flaw create severe organizational risk of data exfiltration, unauthorized system access, and platform disruption. Immediate containment actions are required to prevent compromise.
No vendor-released patch identified at time of analysis. Enforce firewall rules restricting all HTTP access to ATG Portals from untrusted networks; implement network segmentation and air-gapping of the platform from internet-facing segments; deploy WAF policies and intrusion detection rules; disable the vulnerable component if business operations permit; establish continuous security monitoring and log analysis for exploitation indicators; restrict administrative console access and require multi-factor authentication for any remaining access; conduct regular penetration testing and vulnerability scanning to validate mitigation effectiveness.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Commerce Platform
View allA Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Ra
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. Rated high seve
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated at
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated at
Remote takeover in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated at
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Rate
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "
Exploit-DB