What is the CVSS score of CVE-2026-61137?

CVE-2026-61137 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Commerce Platform are affected by CVE-2026-61137?

Oracle Commerce Platform 11.4.0 contains a critical remote vulnerability enabling complete platform takeover by unauthenticated attackers via the Dynamo Application Framework component accessible…

How to fix or mitigate CVE-2026-61137?

Within 24 hours, inventory all systems running Oracle Commerce Platform 11.4.0 and restrict HTTP network access to the Dynamo Application Framework component using firewall rules or network segmentation; audit logs for any prior unauthorized access attempts. Within 7 days, deploy a Web Application Firewall (WAF) with rules to detect and block exploitation attempts to this component, enable enhanced monitoring with alerting on suspicious activity, and disable the Dynamo Application Framework if not essential to business operations. Within 30 days, monitor Oracle's security advisories closely for patch availability; if no patch is released, begin formal assessment of upgrading to supported Oracle Commerce Platform versions (11.5 or later) and engage your Oracle support account regarding extended security support options for 11.4.0.

Oracle Commerce Platform CVE-2026-61137

EUVD-2026-47346 HIGH

Improper Authentication (CWE-287)

2026-07-21 secalert_us@oracle.com

GHSA-hph8-qr89-f778

Oracle Authentication Bypass Commerce Platform

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network HTTP and no auth or interaction give AV:N/PR:N/UI:N; Oracle's 'difficult to exploit' rating justifies AC:H; full platform takeover sets C/I/A all High with unchanged scope.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:36 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Commerce Platform 11.4.0 is possible by a remote unauthenticated attacker who reaches the Dynamo Application Framework component over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation compromises confidentiality, integrity, and availability of the platform (CVSS 3.1 8.1), though Oracle rates it difficult to exploit (AC:H). No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Commerce Platform (the former ATG Web Commerce) is a Java-based enterprise e-commerce suite; the affected piece is the Dynamo Application Framework (DAF), the core runtime that provides component/Nucleus assembly, request handling, form handlers, and page rendering for the storefront and application tier. Because the flaw lives in DAF and is reachable over HTTP without authentication, the exposed attack surface is the web-facing application tier itself rather than an add-on module. Oracle publishes no CWE for this entry, so the precise root-cause class (e.g., deserialization, injection, or authentication bypass) is not disclosed; the 'Information Disclosure' tag and 'takeover' language together suggest a flaw that yields both data exposure and control of the platform.

RemediationAI

Apply the patch delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); this is the vendor's fix channel for Oracle Commerce Platform 11.4.0 - an exact standalone fix build number was not published in the source data, so identify the correct CPU patch for your 11.4.0 installation from the advisory and My Oracle Support. Patch available per vendor advisory. Until the CPU is applied, reduce exposure by restricting network reach to the Dynamo/DAF application tier: place the storefront behind a WAF and reverse proxy, block direct internet access to administrative and Dynamo servlet endpoints, and limit HTTP access to the application servers to trusted networks - trade-off is that overly broad blocking can break legitimate storefront or integration traffic, so validate rules against known request paths. Because Oracle does not disclose the root cause or a specific vulnerable endpoint, these compensating controls are risk-reduction only and are not a substitute for the CPU patch.