What is the CVSS score of CVE-2026-61132?

CVE-2026-61132 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Commerce Platform are affected by CVE-2026-61132?

Oracle Commerce Platform 11.4.0 contains a data isolation flaw (CVE-2026-61132) that allows authenticated users to access sensitive customer and platform data through a web-injection attack vector.

How to fix or mitigate CVE-2026-61132?

Within 24 hours: Audit your environment to identify all Commerce Platform 11.4.0 instances and connected downstream systems, immediately restrict low-privileged user access to sensitive data where operationally feasible, and notify legal and compliance teams of potential data exposure. Within 7 days: Deploy input validation and output encoding controls on all user-facing forms; implement Web Application Firewall (WAF) rules to block injection attack patterns; and conduct targeted user awareness training on social engineering and phishing. Within 30 days: Engage Oracle support to identify available patches or upgrade paths; conduct controlled security testing against this vulnerability profile; implement network segmentation and access controls limiting low-privileged users' reach to sensitive data; and establish formal compensating control documentation for your audit and compliance teams.

Oracle Commerce Platform CVE-2026-61132

EUVD-2026-47341 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-21 secalert_us@oracle.com

GHSA-g453-8pp2-93m3

Authentication Bypass CSRF Oracle Commerce Platform

7.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

vuln.today AI

7.6 HIGH

Authenticated low-priv attacker over HTTP (PR:L, AV:N) needs a victim to interact (UI:R); cross-context execution gives S:C with high confidentiality, limited integrity, no availability loss.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:38 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.6

DescriptionCVE.org

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Platform accessible data as well as unauthorized update, insert or delete access to some of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

AnalysisAI

Cross-context data compromise in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework/ATG) lets a low-privileged, authenticated network attacker who lures a victim into interacting with crafted HTTP content read all platform-accessible data and make limited unauthorized modifications, with impact crossing into additional products via a scope change. The CVSS:3.1 score is 7.6 (C:H/I:L, scope-changed), and the UI:R plus scope-change profile is characteristic of a stored/reflected web-injection class flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Commerce Platform is Oracle's enterprise e-commerce suite (formerly ATG Web Commerce), and the affected component is the Dynamo Application Framework - the core Java application server layer (Nucleus component model, droplets/servlet pipeline, form handlers) that renders and processes storefront and administrative web content. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C, C:H/I:L) is consistent with a web-layer injection weakness where attacker-controlled input is rendered in another user's authenticated context; the scope change (S:C) indicates the vulnerable component and the impacted security authority differ, so payloads executing in a victim's session can reach data or systems beyond the Dynamo component itself. No CWE was assigned in the input, so the exact root-cause class (e.g., improper output neutralization / stored XSS versus a genuine authentication-bypass) cannot be confirmed from NVD data alone.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPUs deliver the patch through the CPU program rather than a standalone tagged version, so treat 'Patch available per vendor advisory' as the status and consult the CPU risk matrix for the exact patch bundle for Commerce Platform 11.4.0 - no discrete fixed version number was provided in the input, so do not assume one. Until the CPU is applied, reduce exposure by restricting and monitoring the low-privilege accounts that could inject content (the flaw needs PR:L), enforcing least privilege on storefront/back-office authoring roles, and adding web-application-firewall rules to filter injection payloads in Dynamo form/droplet parameters; because the attack needs a victim to interact (UI:R), also caution administrators against opening attacker-influenced links or content while authenticated. These controls limit but do not eliminate risk and may cause false positives on legitimate rich content, so schedule the CPU patch as the durable fix.