Oracle Commerce CVE-2026-61153

Exploitation requires network HTTP access to the Oracle Commerce Guided Search / Experience Manager interface of a version 11.4.0 deployment; no authentication, privileges, or user interaction are needed (PR:N/UI:N), and the vulnerability is in the Experience Manager component specifically. The practical limiting factor is reachability: the attacker must be able to send HTTP requests to the affected Experience Manager endpoint, so deployments where that interface is confined to an internal network, behind a VPN, or fronted by an authenticating proxy are substantially harder to reach. There is no availability impact, so this enables data theft and tampering rather than service disruption. Only the single supported version 11.4.0 is named as affected in the source data.

All signals point to genuine priority rather than an inflated CVSS number. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N describes remote, network-reachable exploitation with low attack complexity, no privileges, and no user interaction - the easiest possible precondition profile - and Oracle explicitly characterizes it as 'easily exploitable.' Confidentiality and integrity are both High (complete read and unauthorized create/delete/modify of all accessible data), while availability is unaffected, consistent with an authentication/authorization bypass rather than a crash or DoS. No EPSS score, SSVC decision, POC, or KEV status was provided in the intelligence, so exploitation-probability and automatability signals are unknown; the absence of KEV means no confirmed active exploitation to date. The main risk-limiting factor is exposure: Oracle Commerce/Endeca deployments are typically behind corporate infrastructure, so real-world blast radius depends on whether the Experience Manager HTTP interface is internet-reachable.

An attacker who can reach the Experience Manager HTTP interface sends crafted requests that bypass authentication and directly invoke privileged data operations, reading sensitive catalog/content data and creating, modifying, or deleting critical records without any credentials. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no valid account, user interaction, or complex preconditions are needed - only network access to the service. No public exploit code has been identified at time of analysis, but the low complexity makes independent exploit development plausible.