What is the CVSS score of CVE-2026-61133?

CVE-2026-61133 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Commerce Platform are affected by CVE-2026-61133?

Oracle Commerce Platform 11.4.0 exposes a data disclosure vulnerability in the Dynamo Application Framework allowing unauthenticated remote access to sensitive application data.

How to fix or mitigate CVE-2026-61133?

Within 24 hours, identify all systems running Oracle Commerce Platform 11.4.0 and immediately restrict external network access to affected systems, particularly the Dynamo Application Framework; implement enhanced logging and monitoring of LDAP integration activities to detect unauthorized access attempts. Within 7 days, deploy network segmentation isolating Commerce Platform instances from untrusted networks, restrict LDAP service access to internal systems only, and conduct a data exposure assessment to identify which sensitive information remains accessible through the vulnerability. Within 30 days, monitor Oracle Critical Patch Update releases and apply the vendor patch as soon as it becomes available; conduct forensic review of access logs dating back 90 days to identify any successful exploitation attempts.

Commerce Platform CVE-2026-61133

EUVD-2026-47342 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-vrp3-w3m3-9r2x

Authentication Bypass Oracle Information Disclosure Commerce Platform

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:38 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Commerce Platform 11.4.0 lets a remote, unauthenticated attacker reaching the Dynamo Application Framework's LDAP integration read critical application data, potentially all data accessible to the platform. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score in the provided data, so this is a serious-but-not-yet-weaponized disclosure flaw disclosed in the July 2026 Oracle Critical Patch Update.