EUVD-2026-47339
GHSA-6vm2-wvf9-24gh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Commerce Platform HTTP endpoint
-
DeliverySend crafted request to Dynamo framework
-
ExploitBypass access controls (PR:N)
-
ExecutionRead critical data or trigger repeatable crash
-
ImpactData exposure or complete DOS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be Oracle Commerce Platform 11.4.0 with the Dynamo Application Framework HTTP interface reachable by the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), there are no special conditions - remote unauthenticated exploitation against network-exposed instances of Oracle Commerce Platform, with no authentication, no user interaction, and low attack complexity. The primary limiting factor is network exposure: instances whose Dynamo/HTTP endpoints are confined to internal or management-only networks are not reachable by external attackers. Only version 11.4.0 is confirmed affected, so non-11.4.0 deployments fall outside the stated scope. |
| Impact | Signals point to a genuine priority but with caveats. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes trivially reachable, unauthenticated, network-based exploitation with low complexity, and the C:H/A:H impacts (full data read plus complete DOS) justify the 9.1 score; Oracle explicitly calls it 'easily exploitable.' Counterweighing this, no EPSS score was provided, there is no POC, and it is not in CISA KEV, so there is no evidence of active or imminent mass exploitation yet. No SSVC decision or CWE was supplied. The 'Authentication Bypass' tag is consistent with PR:N but is a third-party label, not an Oracle confirmation - treat the exact mechanism as unverified. Net: high-severity and defensively urgent for anyone running 11.4.0, but current real-world exploitation is unproven rather than confirmed. |
| Exploit ScenarioDerived | An attacker with only network reachability to the storefront sends crafted HTTP requests to the Dynamo Application Framework endpoint, requiring no credentials or user interaction. In one path they retrieve sensitive Commerce Platform data such as customer or order information; in another they repeatedly trigger a hang or crash, producing a sustained, complete denial of service of the storefront. No public POC is currently identified, but the low attack complexity means reliable weaponization is plausible once details circulate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Remote unauthenticated compromise of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a network attacker reach sensitive data and knock the service offline over HTTP. With no authentication or user interaction required and a CVSS 3.1 base of 9.1, a successful attack yields access to all Commerce Platform-accessible data plus a complete, repeatable denial of service. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fixes in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, but no exact fixed build number is stated in the provided data, so obtain the precise patch level for 11.4.0 from the CPU matrix and My Oracle Support. Because exploitation is over HTTP against the Dynamo framework, interim compensating controls include restricting network access to the Commerce Platform HTTP and admin endpoints to trusted management networks and placing a WAF or reverse proxy in front to filter anomalous requests to Dynamo/Nucleus paths - with the trade-off that overly aggressive filtering can break legitimate storefront or DAF servlet traffic. Given the availability impact, also enable monitoring and rate-limiting to detect the repeatable-crash DOS pattern until patching is complete.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Commerce Platform (formerly ATG Web Commerce) is a Java-based enterprise e-commerce suite, and the affected component is its Dynamo Application Framework - the core request-handling, component (Nucleus), and page-rendering layer that fronts storefront and administrative HTTP traffic. Because the flaw sits in this framework rather than a single storefront feature, it is reachable through the platform's normal HTTP interface. Oracle did not assign a CWE (CWE: N/A) and publishes only limited technical detail in its CPU advisory; the third-party tag 'Authentication Bypass' aligns with the CVSS PR:N (no privileges required) rating but is not corroborated by an Oracle root-cause statement, so the precise weakness class is unconfirmed.
Know when Commerce Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Unauthenticated HTTP-reachable framework flaw gives AV:N/AC:L/PR:N/UI:N; full data read (C:H) and complete DOS (A:H) with no integrity impact (I:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Platform accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Platform. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
Executive ViewAI
Oracle Commerce Platform 11.4.0 contains a critical unauthenticated remote vulnerability enabling attackers to access sensitive customer data and disable commerce operations, with no vendor patch currently available. Any organization running this version on internet-facing infrastructure faces immediate risk of data breach and service outage affecting revenue generation and customer trust. Emergency defensive measures are required within 24 hours to minimize financial and reputational exposure while awaiting a vendor fix.
Implement immediate network isolation using a Web Application Firewall (WAF) with rules configured to block exploitation attempts against the Dynamo Application Framework component. Restrict all inbound HTTP/HTTPS traffic to whitelisted internal IP ranges and deploy rate limiting to prevent data exfiltration. Enable comprehensive audit logging with real-time alerting for anomalous access patterns, unauthorized data queries, and unusual traffic spikes. Segment affected systems on isolated network zones with restricted outbound connectivity to minimize lateral movement risk. Maintain continuous monitoring of vendor security advisories for patch availability and conduct weekly access log reviews for indicators of exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Commerce Platform
View allA Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Ra
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. Rated high seve
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated at
Full system takeover of Oracle Commerce Platform 11.4.0 is possible when a remote, unauthenticated attacker reaches the
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated at
Remote takeover in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated at
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Rate
Exploit-DB