What is the CVSS score of CVE-2026-61152?

CVE-2026-61152 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Commerce CVE-2026-61152

EUVD-2026-47360 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-745x-rv23-xvm5

Authentication Bypass Oracle Commerce Guided Search Commerce Experience Manager

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-accessible via HTTP requiring low-privilege authentication; partial read/write impact on platform data only, no availability impact or scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:19 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes low-privileged authenticated users to unauthorized read and write access on platform data via HTTP. Disclosed as part of Oracle's Critical Patch Update for July 2026 and tagged as an authentication bypass issue, the vulnerability enables a low-privileged network attacker to read a subset of data and perform unauthorized insert, update, or delete operations within the Experience Manager component. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Oracle Commerce Guided Search / Oracle Commerce Experience Manager is an enterprise-grade e-commerce personalization and content orchestration platform used primarily by retailers. The affected component, Experience Manager, manages storefront content, merchandising rules, and experience delivery logic accessible over HTTP. No CWE identifier is provided in the available data, but the 'Authentication Bypass' reporter tag strongly implies an authorization control failure - likely improper authorization (related to CWE-285 or CWE-863) where a session holding only low-level privileges can bypass access enforcement to reach data or operations intended for higher-privileged roles. The CVSS vector AV:N/PR:L confirms the exposure surface is a networked HTTP interface requiring only a valid low-privilege session. The sole affected version is 11.4.0, as confirmed by EUVD-2026-47360 and Oracle's July 2026 CPU advisory.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU patches are cumulative, and the advisory should be followed for the specific patch installation procedure applicable to Oracle Commerce 11.4.0. An exact patched release version number is not independently confirmed from available data beyond the CPU advisory itself - consult Oracle support for the definitive fixed version. As compensating controls prior to patching: restrict HTTP access to the Experience Manager component to trusted internal IP ranges via network ACLs or a reverse proxy, enforcing that no external untrusted users can reach the interface; audit and reduce the number of accounts holding any privilege level on the platform to limit the pool of potential exploiters; and apply a web application firewall rule to monitor and alert on anomalous read or write patterns against Experience Manager endpoints. Note that network-layer restrictions may impact legitimate low-privilege user workflows and should be scoped carefully.