What is the CVSS score of CVE-2026-61148?

CVE-2026-61148 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Commerce are affected by CVE-2026-61148?

Any employee or contractor with legitimate access to Oracle Commerce Experience Manager 11.4.0 can exploit a critical privilege escalation flaw to seize complete system control, directly threatening…

How to fix or mitigate CVE-2026-61148?

Within 24 hours, inventory all Oracle Commerce Guided Search/Experience Manager 11.4.0 deployments and restrict HTTP access to essential administrators only via network isolation and IP whitelisting; disable the Experience Manager component if business operations permit. Within 7 days, implement enhanced monitoring of authentication logs for privilege escalation attempts and conduct access reviews to minimize admin account scope. Within 30 days, monitor Oracle's security advisories for vendor patches and upgrade immediately upon availability; if patches remain unavailable beyond 30 days, establish layered compensating controls including WAF monitoring and sustained access restrictions.

Oracle Commerce CVE-2026-61148

EUVD-2026-47356 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-5vqp-c84m-r3vw

Oracle Authentication Bypass Commerce Experience Manager Commerce Guided Search

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP access with low complexity and no interaction, but a low-privileged account is required (PR:L); full component takeover justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:31 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Privilege escalation to full takeover in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a low-privileged attacker with HTTP network access compromise the Experience Manager component, yielding high confidentiality, integrity, and availability impact. Rated CVSS 3.1 8.8 and reported through Oracle's coordinated disclosure (July 2026 CPU), with no public exploit identified at time of analysis and no CISA KEV listing. Any authenticated user of the affected component can potentially seize control of the entire product instance.

Technical ContextAI

Oracle Commerce Guided Search (formerly Endeca) and its Experience Manager module provide faceted search, navigation, and merchandising/content-authoring for large-scale e-commerce sites, exposed over HTTP-based application and workbench services. The flaw resides specifically in the Experience Manager component of version 11.4.0. Oracle publishes no CWE for this issue (CWE: N/A in the input), so the exact root-cause class cannot be confirmed; the vendor's 'Information Disclosure' tag combined with full C/I/A impact and 'takeover' language suggests an access-control or injection weakness that lets a low-privileged authenticated user escalate to full component control rather than a mere read-only disclosure. No CPE strings were supplied in the intelligence, so affected configurations are identified only by the vendor's named product/version.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor-released remediation channel for this CVE; consult that advisory for the exact patch/bundle applicable to Oracle Commerce Guided Search / Experience Manager 11.4.0, as no discrete fixed version string was included in the provided data (patch available per vendor advisory). Because exploitation requires a low-privileged account, interim compensating controls include restricting network access to the Experience Manager and Workbench HTTP endpoints to trusted administrative networks or VPN only, tightening and auditing which accounts hold Experience Manager access, and revoking or rotating low-privilege credentials that no longer need it - with the trade-off that locking down endpoints may disrupt legitimate content authors and merchandisers. These are stopgaps only; prioritize applying the CPU patch, since the vulnerability permits full component takeover.