What is the CVSS score of CVE-2026-61150?

CVE-2026-61150 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Commerce are affected by CVE-2026-61150?

Oracle Commerce Guided Search / Experience Manager 11.4.0 contains a critical vulnerability enabling network-based attackers to access, modify, or delete all application data over HTTP; no public…

How to fix or mitigate CVE-2026-61150?

Within 24 hours, identify all systems running Oracle Commerce Guided Search / Experience Manager 11.4.0 and assess their network accessibility and business criticality. Within 7 days, deploy Oracle's July 2026 Critical Patch Update to all affected instances across development, staging, and production environments. Within 30 days, complete verification of patching across all systems and conduct a review of data access logs and audit trails from the 30 days preceding patching to identify any signs of unauthorized access.

Oracle Commerce CVE-2026-61150

EUVD-2026-47358 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-5xvm-vc7v-r7g9

Authentication Bypass Oracle Commerce Experience Manager Commerce Guided Search

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reachable with low attack complexity and a required low-privilege account (PR:L), full read/write to accessible data (C:H/I:H) but no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:30 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all data accessible to the application. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact) and tagged as an authentication-bypass-class issue by the reporter. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix ships in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Commerce Guided Search (formerly Endeca) and its Experience Manager provide faceted search, merchandising, and content-driven experience management for Oracle's ATG/Commerce e-commerce stack. The flaw resides specifically in the Experience Manager component, the administrative/content authoring layer, and is reachable over HTTP. Oracle does not publish a CWE for this issue (CWE: N/A) and the technical root cause is not disclosed in the advisory, but the reporter tag 'Authentication Bypass' together with a PR:L requirement suggests a broken access-control or privilege-scoping weakness that lets an already-authenticated low-privileged principal reach data or operations outside its authorization boundary rather than a fully pre-authentication bypass.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to Oracle Commerce Guided Search / Experience Manager 11.4.0; the advisory lists Patch available per vendor advisory, though no discrete fix version string was included in the provided data, so obtain the exact patch bundle from the CPU matrix. Because exploitation requires a low-privileged authenticated session, compensating controls until patching include restricting network access to the Experience Manager administrative endpoints to trusted admin networks or VPN only (side effect: remote content authors lose direct access), tightening and auditing low-privilege application accounts and revoking unneeded ones, and placing a reverse proxy or WAF in front of the Experience Manager interface to log and constrain requests (side effect: possible false positives on legitimate merchandising operations). Do not expose the Commerce admin tier directly to the internet.