What is the CVSS score of CVE-2026-61134?

CVE-2026-61134 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Oracle Commerce Platform CVE-2026-61134

EUVD-2026-47343 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-cjjj-jp55-4rff

Authentication Bypass Oracle Commerce Platform

6.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.8 MEDIUM

Network vector confirmed; AC:H and PR:L reflect exploit complexity and mandatory low-privileged auth; no availability impact per description.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:20 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Platform accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Authentication bypass in Oracle Commerce Platform 11.4.0 exposes full data confidentiality and integrity through the Dynamo Application Framework component, allowing a low-privileged network attacker to read or modify all platform data via HTTP. The CVSS 3.1 score of 6.8 reflects meaningful exploitation complexity (AC:H) and the requirement for at least some authenticated access (PR:L), limiting opportunistic mass exploitation. No public exploit code or active exploitation has been identified at time of analysis, and remediation is available via Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Commerce Platform (formerly ATG Web Commerce) is a Java-based enterprise e-commerce suite built on the Dynamo Application Framework (DAF), Oracle's proprietary server-side component model responsible for request processing pipelines, session management, and security context enforcement. The affected version is specifically 11.4.0 (CPE inferred: oracle:commerce_platform:11.4.0). The 'Authentication Bypass' tag in conjunction with the CVSS PR:L metric indicates a flaw within the DAF's authorization or access control layer that can be exploited by a low-privileged authenticated user to escalate their effective permissions. No CWE is assigned, so the precise root cause class - whether improper access control (CWE-284), authorization bypass (CWE-863), or session handling flaw - cannot be confirmed from available data; the bypass mechanism must be inferred from the description and tags alone.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, which addresses this vulnerability for Oracle Commerce Platform 11.4.0. The advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number was not independently confirmed in the available data - consult the Oracle CPU directly for the precise patch artifact. If immediate patching is not feasible, implement network-layer controls to restrict HTTP access to the Oracle Commerce administrative and framework endpoints to trusted internal IP ranges only, reducing the attack surface to users who already have low-privileged access. Additionally, audit all low-privileged user accounts for necessity and enforce the principle of least privilege to limit the population of potential exploiters. Note that access restriction is a compensating control, not a fix - the underlying bypass remains present until the patch is applied.