Oracle Commerce CVE-2026-61149

Exploitation requires network HTTP access to the Oracle Commerce Experience Manager component of Guided Search version 11.4.0, plus a low-privileged authenticated account (CVSS PR:L), and no user interaction (UI:N). What limits exploitation: the attacker must already hold valid low-level credentials to the Experience Manager application, and the component is typically an internal merchandising/authoring console rather than a public storefront, so real exposure depends on whether that interface is reachable by the attacker; only version 11.4.0 is named as affected. No special non-default configuration is called out in the description.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) signals an easily exploitable, network-reachable flaw needing only low privileges and no user interaction, with total compromise of the component - a genuinely high-priority profile for any exposed Oracle Commerce instance. That said, no EPSS score, no SSVC decision, and no KEV listing were provided, and no public exploit has been identified, so there is no evidence of active or automatable exploitation yet; the realistic exposure is bounded by the fact that Experience Manager is typically an internal merchandising console rather than an internet-facing storefront. One point to verify with the vendor: Oracle tags this 'Information Disclosure' while the CVSS impact and description say 'takeover' with full I and A impact - the CVSS is the more severe and should drive prioritization, but the discrepancy suggests confirming exact impact against Oracle's advisory.

A low-privileged user with a valid Experience Manager account (or an attacker who has phished/obtained such credentials) sends crafted HTTP requests to the authoring component and, requiring no further interaction from any victim, escalates to full control of the Guided Search / Experience Manager instance - reading, altering, or disrupting merchandising content and data. Because AC:L and UI:N, the attack is straightforward to reproduce once network and low-privilege access exist, though no public proof-of-concept has been identified at time of analysis.