What is the CVSS score of CVE-2026-61145?

CVE-2026-61145 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Commerce Guided Search are affected by CVE-2026-61145?

Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a critical remote takeover vulnerability (CVSS 9.8) in the Content Acquisition System component that requires no…

How to fix or mitigate CVE-2026-61145?

Within 24 hours: identify all systems running Oracle Commerce GS/CEM 11.4.0, verify network connectivity paths, and engage Oracle support for emergency patching timeline. Within 7 days: deploy network-level access controls restricting HTTP/HTTPS traffic to this component to trusted endpoints only, implement or enhance WAF rules to detect exploitation attempts, enable detailed logging on all Content Acquisition System endpoints, and segment affected systems from critical production workloads if isolation is possible. Within 30 days: apply vendor-released patch immediately upon availability, conduct forensic review of access logs for exploitation evidence, rotate all credentials with access to affected systems, and execute vulnerability reassessment post-patch.

Oracle Commerce Guided Search CVE-2026-61145

EUVD-2026-47353 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-fw4w-m9j8-c5pv

Oracle Authentication Bypass Commerce Experience Manager Commerce Guided Search

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor describes easily exploitable, unauthenticated HTTP takeover with no user interaction, giving AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H; no scope change indicated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:34 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Content Acquisition System component) allows an unauthenticated attacker with HTTP network access to fully compromise the product. Oracle rates it CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning no authentication or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, unauthenticated 'takeover' profile makes it a top-tier patching priority.

Technical ContextAI

Oracle Commerce Guided Search (the platform historically derived from Oracle Endeca) and its Experience Manager provide faceted search, navigation, and merchandising for enterprise e-commerce sites. The affected component is the Content Acquisition System (CAS), the subsystem responsible for crawling, ingesting, and processing source content/records into the search index; it exposes HTTP service interfaces used for record acquisition and pipeline management. Oracle does not assign a CWE (CWE: N/A) and does not disclose the root-cause class, but the 'takeover via HTTP by an unauthenticated attacker' pattern in an ingestion/service component is consistent with a missing-authentication or injection/deserialization class flaw reachable over the CAS network interface. Exact affected identification is version-based rather than CPE-based here: no CPE string is provided in the intelligence, only the EUVD-listed product string 'Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0.'

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though this intelligence does not include a discrete fixed build number, so obtain the exact patch level for Commerce Guided Search 11.4.0 directly from that CPU and the linked patch matrix. Because the flaw is unauthenticated and reachable over HTTP against the Content Acquisition System, until patching is complete restrict network access to the CAS service ports/endpoints so they are reachable only from trusted internal hosts and management networks rather than the public internet or the general corporate LAN, and place the CAS/Experience Manager administrative interfaces behind a VPN or reverse proxy with authentication; the trade-off is that any legitimate remote content-ingestion or authoring integrations must be explicitly allowlisted or they will break. Monitor CAS HTTP logs for anomalous acquisition requests as a detective control. Do not rely on the 'Information Disclosure' tag to scope hardening - protect against full compromise.