What is the CVSS score of CVE-2026-61135?

CVE-2026-61135 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Commerce Platform are affected by CVE-2026-61135?

Oracle Commerce Platform 11.4.0 contains a critical vulnerability enabling remote, unauthenticated attackers to access, modify, and delete all data accessible to the platform.

How to fix or mitigate CVE-2026-61135?

Within 24 hours, inventory all systems running Oracle Commerce Platform 11.4.0 and immediately restrict network access to affected instances using firewall rules or Web Application Firewall policies; document all connected systems and data flows for risk assessment. Within 7 days, implement compensating controls including strict IP whitelisting, enforce HTTPS-only connectivity, enable comprehensive audit logging of all data access, and deploy monitoring to detect suspicious read/modify/delete patterns. Within 30 days, contact Oracle support to identify available upgrade paths from 11.4.0, establish a remediation timeline with business stakeholders, and implement temporary data isolation for critical assets if upgrade timeline extends beyond 90 days.

Oracle Commerce Platform CVE-2026-61135

EUVD-2026-47344 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-49rr-39cq-x5ph

Authentication Bypass Oracle Commerce Platform

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Network-reachable and unauthenticated (AV:N/PR:N) but vendor-confirmed difficult to exploit (AC:H); full data read and write (C:H/I:H) with no service disruption (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:37 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.4

DescriptionCVE.org

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Platform accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a remote, unauthenticated attacker read, create, modify, or delete all data accessible to the platform over HTTP. The flaw carries a CVSS 3.1 score of 7.4 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as difficult to exploit (AC:H). Disclosed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Commerce Platform (formerly ATG Web Commerce) is a Java-based enterprise e-commerce suite; the affected component is the Dynamo Application Framework (DAF), the core runtime that provides the Nucleus component container, request-handling pipeline, and data-anywhere/repository layer underpinning storefront and business applications. The vulnerability is reached over HTTP against the application framework itself rather than a single storefront page, which is why impact spans 'all Oracle Commerce Platform accessible data.' Oracle did not assign a CWE (CWE: N/A), but the third-party 'Authentication Bypass' tag combined with PR:N and full read/write data impact is consistent with a missing or improper access-control / authentication weakness (CWE-287/CWE-306 class) in a framework request handler. Exact root cause is not published by Oracle, whose advisories are historically terse.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though Oracle CPUs deliver cumulative bundle/interim patches rather than a single tagged product version, so no distinct fixed version string is provided in the input - obtain the specific 11.4.0 patch from My Oracle Support. Until the patch is applied, reduce exposure by restricting network reachability of the Commerce Platform and Dynamo request endpoints: place the application behind a WAF or reverse proxy and limit inbound HTTP to trusted networks or authenticated ingress, and monitor for anomalous data-access or unauthenticated requests to DAF/Nucleus handlers. These network restrictions can break legitimate storefront traffic if applied to public-facing storefronts, so scope them to admin/framework endpoints where possible; treat them as temporary compensating controls, not a substitute for the CPU patch.