What is the CVSS score of CVE-2026-61151?

CVE-2026-61151 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Commerce are affected by CVE-2026-61151?

Oracle Commerce Guided Search / Experience Manager 11.4.0 contains a data access vulnerability allowing low-privileged attackers to read all accessible data and make unauthorized modifications,…

How to fix or mitigate CVE-2026-61151?

Within 24 hours, identify all instances of Oracle Commerce Experience Manager 11.4.0 in your environment and document which systems store sensitive data; simultaneously pull and review access logs from the past 30 days to identify suspicious activity from low-privileged accounts. Within 7 days, restrict HTTP access to Experience Manager components to trusted administrative networks only via firewall rules, enforce multi-factor authentication for all accounts with system access, and deploy enhanced audit logging capturing all data read and write events with alerting on anomalies. Within 30 days, subscribe to Oracle's Critical Patch Update notifications, develop an upgrade plan to deploy patches to Experience Manager 11.4.0 immediately upon release, and complete a comprehensive data audit from July 2026 forward to confirm no unauthorized access or data modification occurred.

Oracle Commerce CVE-2026-61151

EUVD-2026-47359 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-q8qx-v9fx-h649

Authentication Bypass Oracle Commerce Experience Manager Commerce Guided Search

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network HTTP reach with low complexity and no interaction; PR:L reflects the required low-privilege account; high confidentiality and limited integrity impact, no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:29 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a low-privileged, network-based attacker over HTTP to gain complete read access to all accessible data plus limited update, insert, and delete capability. Rated CVSS 7.1 and tagged as an authentication bypass, it was disclosed by Oracle in the July 2026 Critical Patch Update and requires only low-level credentials with no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

Oracle Commerce (the former ATG Web Commerce and Endeca platform) is an enterprise e-commerce suite; Guided Search/Endeca provides faceted product search and the Experience Manager is the business-user tooling used to author and control merchandising and search-result presentation. The vulnerable component is Experience Manager in version 11.4.0, reached over HTTP. Oracle does not assign a CWE (CWE: N/A) and provides no root-cause detail, but the vendor-supplied 'Authentication Bypass' tag combined with a low-privilege prerequisite (PR:L) points to a broken access-control or authorization flaw that lets an authenticated low-tier user reach data or operations intended for higher-privileged roles, rather than a fully unauthenticated bypass.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though no discrete fix version string was published in the provided data beyond the CPU bundle, so administrators should map CVE-2026-61151 to the exact patch for Oracle Commerce 11.4.0 within that CPU. Because exploitation requires network access over HTTP with low privileges, interim compensating controls include restricting network reachability of the Experience Manager interface to trusted management networks or VPN only, placing it behind a reverse proxy or WAF that enforces authentication and blocks unauthenticated or anomalous requests, and tightening role/account provisioning to minimize the number of low-privilege accounts that can reach the component. These controls reduce exposure but do not remediate the underlying authorization flaw, and network restrictions may impede legitimate remote merchandising users, so patching remains the priority.