What is the CVSS score of CVE-2026-61129?

CVE-2026-61129 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Commerce Platform are affected by CVE-2026-61129?

Oracle Commerce Platform 11.4.0 contains a critical vulnerability enabling unauthenticated remote attackers to achieve full system compromise via the ATG Portals component (CVSS 9.8).

How to fix or mitigate CVE-2026-61129?

Within 24 hours: isolate all Oracle Commerce Platform 11.4.0 instances from internet-facing networks or implement strict firewall rules limiting HTTP access to the ATG Portals component to trusted internal sources only; if operationally feasible, disable the ATG Portals component immediately. Within 7 days: deploy intrusion detection signatures and Web Application Firewall (WAF) rules to detect exploitation attempts, conduct forensic analysis to determine whether systems have been compromised, and complete a comprehensive inventory of all Commerce Platform 11.4.0 instances across the enterprise. Within 30 days: contact Oracle support to determine patch availability and timeline for version 11.4.0, establish a formal upgrade path to a patched release, and implement permanent network segmentation ensuring the platform is never directly exposed to untrusted networks.

Oracle Commerce Platform CVE-2026-61129

EUVD-2026-47338 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-c35r-wmmq-534h

Oracle Authentication Bypass Commerce Platform

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor describes easily exploitable, unauthenticated HTTP-reachable takeover with full CIA loss, so AV:N/AC:L/PR:N/UI:N and C/I/A:H; scope unchanged as compromise stays within the platform.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:39 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: ATG Portals). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full system takeover of Oracle Commerce Platform 11.4.0 is possible when a remote, unauthenticated attacker reaches the ATG Portals component over HTTP. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and yields complete compromise of the platform. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

Oracle Commerce Platform (formerly Oracle ATG Web Commerce) is a Java-based enterprise e-commerce framework built on Oracle's ATG (Art Technology Group) Dynamo Application Framework, typically deployed on WebLogic/JBoss application servers. The vulnerable component is ATG Portals, the portal/gadget module that renders personalized storefront and portal content. Oracle did not assign a CWE (listed as N/A) and, per its usual Critical Patch Update practice, withholds root-cause detail; the AV:N/AC:L/PR:N/UI:N vector combined with 'takeover' impact is consistent with the deserialization, injection, or authentication-bypass classes historically seen in ATG/portal components, but the exact weakness class is not disclosed in the available data.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); the input does not name an exact patched build number, so this is best described as a patch available per vendor advisory rather than a specific confirmed fix version - obtain the exact Commerce Platform 11.4.0 CPU patch from My Oracle Support and verify the version after applying. Because the ATG Portals component is remotely and unauthenticatedly reachable over HTTP, compensating controls until patching completes include restricting network access to the Commerce/portal HTTP endpoints via WAF or firewall allow-listing (side effect: may block legitimate external storefront/portal traffic if applied too broadly, so scope to admin/portal paths where possible), placing the application behind authenticated reverse-proxy access for non-public portal functions, and disabling or restricting the ATG Portals module if it is not required for the deployment (side effect: loss of portal/gadget functionality). Increase monitoring of HTTP requests to portal endpoints for anomalous activity while the patch is staged.