What is the CVSS score of CVE-2026-61131?

CVE-2026-61131 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Commerce Platform are affected by CVE-2026-61131?

Oracle Commerce Platform 11.4.0 contains a critical unauthenticated remote code execution vulnerability (CVE-2026-61131, CVSS 9.8) that permits attackers to gain complete system control without…

How to fix or mitigate CVE-2026-61131?

Within 24 hours: Inventory all Oracle Commerce Platform 11.4.0 instances in production and development, document network exposure, and immediately implement firewall rules restricting inbound HTTP/HTTPS access to the Dynamo Application Framework component to authorized networks only; consider temporary network segmentation or air-gapping if exposure cannot be reduced. Within 7 days: Deploy Web Application Firewall rules targeting the vulnerable component (monitor Oracle CPU advisories for published indicators), implement enhanced audit logging on affected systems, test upgrade procedures to Oracle Commerce Platform 12.x or later in non-production environments, and confirm the target version contains the fix. Within 30 days: Execute production upgrade to a patched platform version, or if operationally infeasible, establish permanent network isolation as a long-term compensating control while pursuing a sustained upgrade roadmap.

Oracle Commerce Platform CVE-2026-61131

EUVD-2026-47340 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-vqg7-q7mc-xx67

Oracle Authentication Bypass Commerce Platform

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated, easily exploitable HTTP-based takeover, giving AV:N/AC:L/PR:N/UI:N with full C:H/I:H/A:H; scope unchanged as compromise stays within the platform.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:39 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with HTTP network access to fully compromise the product, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 9.8 (Critical) rating. Oracle describes the flaw as easily exploitable, though it publishes no technical root-cause detail beyond the CPU advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated network reach and complete system takeover makes this a top-tier patch priority.

Technical ContextAI

The affected component is the Dynamo Application Framework (ATG/Dynamo), the Java-based application server and request-handling framework underpinning Oracle Commerce Platform (formerly Oracle ATG Web Commerce). Dynamo handles HTTP request routing, session/component (Nucleus) management, and page rendering for large e-commerce storefronts, so a network-reachable flaw in this layer exposes the core of the storefront. Oracle assigned no CWE (CWE: N/A) and the advisory withholds the specific weakness class, but the CVSS profile (network vector, no auth, full CIA loss) is consistent with an injection, deserialization, or authentication/authorization bypass leading to code execution or full data access - the exact mechanism is not confirmed from the available data. No CPE strings were provided; affected scope is expressed only as Oracle Commerce Platform 11.4.0.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 as the primary remediation - consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch/bundle for Oracle Commerce Platform 11.4.0 (Patch available per vendor advisory; no standalone fixed version string was provided in the input, so verify the precise patch number in the CPU matrix). Because the vector is unauthenticated HTTP, until patching completes, restrict network exposure of the Dynamo/storefront and administration endpoints to trusted networks or place them behind a WAF/reverse proxy with rules limiting anomalous HTTP requests, and tightly firewall any Dynamo admin or Nucleus management ports from the public internet - trade-off: WAF virtual patching is generic since Oracle publishes no request signature, and blocking storefront HTTP is usually not viable for public commerce sites, so prioritize the actual patch. As Oracle CPU patches are cumulative, applying the July 2026 CPU also addresses other fixed issues; schedule it in an emergency maintenance window given the 9.8 rating.