What is the CVSS score of CVE-2026-61153?

CVE-2026-61153 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Commerce are affected by CVE-2026-61153?

Oracle Commerce Guided Search / Experience Manager 11.4.0 contains a critical authentication bypass enabling unauthenticated attackers to read and modify all application data without credentials.

How to fix or mitigate CVE-2026-61153?

Within 24 hours: Identify all systems running Oracle Commerce Guided Search / Experience Manager 11.4.0 and isolate them from untrusted networks using firewall rules; enable full audit logging of data access and API calls to detect exploitation. Within 7 days: Deploy Web Application Firewall rules to enforce authentication validation; contact Oracle support to confirm patch timeline and evaluate upgrade feasibility to Commerce 12.x or later; assess whether Guided Search functionality can be temporarily disabled if non-critical. Within 30 days: Execute upgrade to a patched version of Oracle Commerce or implement compensating controls including API gateway authentication enforcement, data encryption in transit (TLS 1.3), and real-time alerting on unauthorized data modifications.

Oracle Commerce CVE-2026-61153

EUVD-2026-47361 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-qmfm-4hm3-fmx7

Authentication Bypass Oracle Commerce Guided Search Commerce Experience Manager

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Remote unauthenticated HTTP access with low complexity (AV:N/AC:L/PR:N/UI:N); authentication bypass yields full read and modify of data (C:H/I:H) but no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:29 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a remote, unauthenticated attacker to read and modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact) and is easily exploitable per Oracle. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-privileges vector makes it a high-priority patch.

Technical ContextAI

Oracle Commerce Guided Search (formerly Endeca) with the Experience Manager component is an enterprise search-and-merchandising platform used to power faceted product search and content-driven experiences on e-commerce sites. The affected element is the Experience Manager component in version 11.4.0. Oracle did not assign a CWE (listed N/A), but the vendor tag 'Authentication Bypass' and the CVSS vector (PR:N with high C and I impact) point to a missing or improperly enforced authentication/authorization check on an HTTP-facing interface, letting requests reach privileged data-management functions without valid credentials. No CPE strings were supplied in the intelligence; product/version scoping comes from Oracle's advisory and the ENISA EUVD entry.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPUs are cumulative, so the CPU July 2026 bundle for Oracle Commerce 11.4.0 is the primary and authoritative remediation. Oracle did not publish a discrete fixed version number in the provided data beyond the CPU reference, so administrators should map their installation to the specific patch listed in that advisory. Until patching is possible, restrict network exposure of the Experience Manager HTTP interface: place it behind a VPN or internal-only network segment, use a reverse proxy or WAF to require authentication and block unauthenticated access to Experience Manager management endpoints, and limit source IPs to trusted administrative hosts - the trade-off is that overly broad blocking may break legitimate merchandiser/administrator workflows and integrations that rely on that interface, so validate rules against known-good traffic first.