What is the CVSS score of CVE-2026-61130?

CVE-2026-61130 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Commerce Platform are affected by CVE-2026-61130?

Oracle Commerce Platform 11.4.0 contains a critical unauthenticated remote vulnerability enabling attackers to access sensitive customer data and disable commerce operations, with no vendor patch…

How to fix or mitigate CVE-2026-61130?

Within 24 hours, immediately isolate all Oracle Commerce Platform 11.4.0 instances from direct internet exposure by deploying them behind a Web Application Firewall (WAF) and restricting HTTP/HTTPS access to whitelisted internal IP addresses only; simultaneously enable detailed audit logging on all inbound requests to capture access patterns. Within 7 days, complete a full inventory of all 11.4.0 deployments across the organization, classify their data sensitivity and business criticality, and establish direct contact with Oracle to track patch release timelines. Within 30 days, execute an upgrade plan to migrate affected systems to the next patched Oracle Commerce Platform release once the vendor releases fixes; if 30-day upgrade timelines are infeasible, deploy persistent WAF rules targeting known Dynamo Application Framework exploitation patterns and establish continuous 24/7 monitoring for exploitation attempts or unauthorized data access anomalies.

Oracle Commerce Platform CVE-2026-61130

EUVD-2026-47339 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-6vm2-wvf9-24gh

Authentication Bypass Oracle Commerce Platform

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated HTTP-reachable framework flaw gives AV:N/AC:L/PR:N/UI:N; full data read (C:H) and complete DOS (A:H) with no integrity impact (I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:40 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Platform accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Platform. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).

AnalysisAI

Remote unauthenticated compromise of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a network attacker reach sensitive data and knock the service offline over HTTP. With no authentication or user interaction required and a CVSS 3.1 base of 9.1, a successful attack yields access to all Commerce Platform-accessible data plus a complete, repeatable denial of service. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Commerce Platform (formerly ATG Web Commerce) is a Java-based enterprise e-commerce suite, and the affected component is its Dynamo Application Framework - the core request-handling, component (Nucleus), and page-rendering layer that fronts storefront and administrative HTTP traffic. Because the flaw sits in this framework rather than a single storefront feature, it is reachable through the platform's normal HTTP interface. Oracle did not assign a CWE (CWE: N/A) and publishes only limited technical detail in its CPU advisory; the third-party tag 'Authentication Bypass' aligns with the CVSS PR:N (no privileges required) rating but is not corroborated by an Oracle root-cause statement, so the precise weakness class is unconfirmed.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, but no exact fixed build number is stated in the provided data, so obtain the precise patch level for 11.4.0 from the CPU matrix and My Oracle Support. Because exploitation is over HTTP against the Dynamo framework, interim compensating controls include restricting network access to the Commerce Platform HTTP and admin endpoints to trusted management networks and placing a WAF or reverse proxy in front to filter anomalous requests to Dynamo/Nucleus paths - with the trade-off that overly aggressive filtering can break legitimate storefront or DAF servlet traffic. Given the availability impact, also enable monitoring and rate-limiting to detect the repeatable-crash DOS pattern until patching is complete.