EUVD-2026-47340
GHSA-vqg7-q7mc-xx67
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach storefront HTTP endpoint
-
DeliverySend crafted request to Dynamo framework
-
ExploitTrigger unauthenticated flaw (no login)
-
ExecutionAchieve platform takeover
-
ImpactAccess commerce data and systems
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The exploitable surface is the Dynamo Application Framework reachable over HTTP on an Oracle Commerce Platform 11.4.0 deployment; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation is possible against network-reachable instances with no user interaction. The primary limiting factors are version and reachability: the product must be the affected 11.4.0 release and its HTTP interface must be accessible to the attacker, so instances isolated behind VPN/allowlists or already patched via the July 2026 CPU are not exposed. Oracle does not document any non-default feature or configuration prerequisite, so default network-facing storefronts should be treated as vulnerable. |
| Impact | All CVSS signals point to maximum severity: AV:N/AC:L/PR:N/UI:N means a remote, unauthenticated attacker over HTTP with no user interaction and low complexity, and C:H/I:H/A:H (Scope:Unchanged) means complete compromise of the platform - Oracle's 9.8 and its 'easily exploitable' language reinforce this. However, the exploitation-probability picture is incomplete: no EPSS score was provided, there is no POC/public exploit identified, and the CVE is not in CISA KEV, so there is currently no evidence of active or automated exploitation. The tags list 'Information Disclosure,' which understates the advisory's stated 'takeover' outcome - treat the CVSS CIA:H/takeover description as authoritative over the tag. Net assessment: this is a genuine high-priority vulnerability driven by pre-conditions (unauthenticated + network + full impact) rather than by observed exploitation; the missing EPSS/POC data lowers confidence in near-term mass-exploitation likelihood but does not reduce the intrinsic risk. Note the CWE is N/A and Oracle provides no technical detail, so root-cause-specific mitigations cannot be tailored. |
| Exploit ScenarioDerived | An attacker who can reach an internet-facing Oracle Commerce storefront sends a crafted HTTP request to the Dynamo Application Framework and, with no authentication or user interaction, triggers the flaw to gain full control of the platform and its customer/order data. Given the low attack complexity Oracle describes it as 'easily exploitable,' though no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with HTTP network access to fully compromise the product, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 9.8 (Critical) rating. Oracle describes the flaw as easily exploitable, though it publishes no technical root-cause detail beyond the CPU advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated network reach and complete system takeover makes this a top-tier patch priority.
RemediationAI
Apply the fixes from the Oracle Critical Patch Update of July 2026 as the primary remediation - consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch/bundle for Oracle Commerce Platform 11.4.0 (Patch available per vendor advisory; no standalone fixed version string was provided in the input, so verify the precise patch number in the CPU matrix). Because the vector is unauthenticated HTTP, until patching completes, restrict network exposure of the Dynamo/storefront and administration endpoints to trusted networks or place them behind a WAF/reverse proxy with rules limiting anomalous HTTP requests, and tightly firewall any Dynamo admin or Nucleus management ports from the public internet - trade-off: WAF virtual patching is generic since Oracle publishes no request signature, and blocking storefront HTTP is usually not viable for public commerce sites, so prioritize the actual patch. As Oracle CPU patches are cumulative, applying the July 2026 CPU also addresses other fixed issues; schedule it in an emergency maintenance window given the 9.8 rating.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Dynamo Application Framework (ATG/Dynamo), the Java-based application server and request-handling framework underpinning Oracle Commerce Platform (formerly Oracle ATG Web Commerce). Dynamo handles HTTP request routing, session/component (Nucleus) management, and page rendering for large e-commerce storefronts, so a network-reachable flaw in this layer exposes the core of the storefront. Oracle assigned no CWE (CWE: N/A) and the advisory withholds the specific weakness class, but the CVSS profile (network vector, no auth, full CIA loss) is consistent with an injection, deserialization, or authentication/authorization bypass leading to code execution or full data access - the exact mechanism is not confirmed from the available data. No CPE strings were provided; affected scope is expressed only as Oracle Commerce Platform 11.4.0.
Know when Commerce Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle states unauthenticated, easily exploitable HTTP-based takeover, giving AV:N/AC:L/PR:N/UI:N with full C:H/I:H/A:H; scope unchanged as compromise stays within the platform.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Commerce Platform 11.4.0 contains a critical unauthenticated remote code execution vulnerability (CVE-2026-61131, CVSS 9.8) that permits attackers to gain complete system control without credentials, exposing confidentiality, integrity, and availability of the platform. Any organization operating this version faces immediate risk of data breach, service disruption, and business continuity failure. The absence of a vendor-supplied patch makes this a top-tier emergency requiring network isolation or urgent system replacement.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access via firewall rules and network segmentation, permitting only authorized source IP ranges; (2) Deploy Web Application Firewall with Dynamo Application Framework rules (monitor Oracle advisory for published signatures and IOCs); (3) Implement enhanced monitoring and alerting for exploitation indicators (unexpected process spawning, outbound connections, anomalous authentication); (4) Disable or deactivate the Oracle Commerce Platform service if business operations permit until patched version is available; (5) Prioritize upgrade to unaffected versions as the definitive remediation control.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Commerce Platform
View allA Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Ra
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. Rated high seve
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Full system takeover of Oracle Commerce Platform 11.4.0 is possible when a remote, unauthenticated attacker reaches the
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated at
Remote takeover in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated at
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Rate
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "
Exploit-DB