Oracle Commerce CVE-2026-61151

Exploitation requires network access to the Experience Manager component of Oracle Commerce Guided Search / Experience Manager 11.4.0 over HTTP and, per the CVSS PR:L metric, a low-privileged authenticated account on the application; no user interaction is needed (UI:N) and no unusual product configuration is cited in the description. Limiting factors: the target must be version 11.4.0, the Experience Manager interface must be reachable by the attacker, and the attacker must hold at least a low-privilege credential - unless the 'Authentication Bypass' tag proves that authentication can be circumvented, in which case the privilege prerequisite is weaker than CVSS PR:L implies and this discrepancy should be verified with Oracle before relying on authentication as a control. Impact is limited to confidentiality and partial integrity (A:N), so availability is not directly at risk.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1) describes an easily exploitable, network-reachable flaw needing only low privileges and no user interaction, with high confidentiality impact and limited integrity impact. Oracle itself characterizes it as 'easily exploitable,' which raises practical concern for internet- or intranet-exposed deployments. However, no EPSS score, KEV listing, POC, or SSVC decision data was provided, so real-world exploitation likelihood cannot be quantified - there is no public exploit identified at time of analysis and it is not confirmed actively exploited. Note a signal tension: the CVSS carries PR:L (authenticated low privilege) yet the intelligence tag reads 'Authentication Bypass'; these are not fully consistent, so the exact privilege prerequisite should be verified against Oracle's advisory before deprioritizing based on the assumption that valid credentials are required.

A low-privileged user (for example a limited merchandising or catalog account, or an attacker who has obtained such credentials) sends crafted HTTP requests to the Experience Manager component and, due to weak authorization enforcement, reads all data the application can access and performs some unauthorized inserts, updates, or deletes. Given Oracle's 'easily exploitable' rating and low attack complexity, the technical bar is low, though no public proof-of-concept has been identified at time of analysis.