What is the CVSS score of CVE-2026-61149?

CVE-2026-61149 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Commerce are affected by CVE-2026-61149?

Organizations using Oracle Commerce Guided Search and Experience Manager 11.4.0 face complete system compromise through existing low-privilege user accounts, creating immediate risk to customer data,…

How to fix or mitigate CVE-2026-61149?

Within 24 hours, immediately inventory all systems running Oracle Commerce Guided Search/Experience Manager 11.4.0 and restrict HTTP access to the Experience Manager component to essential administrative users only, blocking all non-administrative traffic. Within 7 days, enforce multi-factor authentication and VPN requirements for all Experience Manager access, implement real-time access logging with alerting on the component, and conduct forensic review of access logs for signs of exploitation. Within 30 days, establish monitoring for Oracle Critical Patch Update availability, conduct patch testing in non-production environments, and develop a staged production deployment plan once the vendor patch becomes available.

Oracle Commerce CVE-2026-61149

EUVD-2026-47357 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-rqfx-65fr-r7j3

Oracle Privilege Escalation Commerce Experience Manager Commerce Guided Search

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP-reachable component, low complexity and no user interaction, but a valid low-privileged account is required (PR:L); described takeover yields full C/I/A impact within one system (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:30 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible for an authenticated low-privileged attacker reaching the Experience Manager component over HTTP. Rated CVSS 3.1 8.8 with full confidentiality, integrity, and availability impact, this flaw was disclosed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Commerce (formerly ATG/Endeca) is an enterprise e-commerce platform; the affected Experience Manager component of Guided Search is the merchandising and content-authoring tool built on the Endeca engine and exposed via HTTP-based administrative/authoring interfaces. The vulnerability lives in this web-facing component and, per Oracle's tags, has an Information Disclosure characteristic, though the CVSS profile (C:H/I:H/A:H, 'takeover') indicates it goes well beyond read-only exposure. Oracle does not assign a CWE (CWE: N/A) and does not publish root-cause detail in CPU advisories, so the exact weakness class (e.g., access-control bypass, injection, or deserialization) cannot be confirmed from the available data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; no exact fixed build number is stated in the provided data, so obtain the specific 11.4.0 patch set from the CPU matrix and your Oracle support portal. Until patched, restrict network access to the Experience Manager / Guided Search authoring and administrative HTTP endpoints so they are reachable only from trusted internal management networks or via VPN, and tighten account provisioning to remove unnecessary low-privileged accounts since the attack requires only PR:L; note the trade-off that network restrictions may disrupt distributed merchandising teams who author content remotely. Monitor Experience Manager authentication and admin activity logs for anomalous low-privilege account behavior as a detective control.