What is the CVSS score of CVE-2026-61154?

CVE-2026-61154 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Commerce Guided Search are affected by CVE-2026-61154?

Oracle Commerce Guided Search Platform Services 11.4.0 is vulnerable to unauthenticated remote code execution with a CVSS score of 9.8, allowing attackers to achieve complete system takeover without…

How to fix or mitigate CVE-2026-61154?

Within 24 hours: Inventory all Oracle Commerce Guided Search Platform Services 11.4.0 deployments; immediately restrict network access to the Forge component to trusted internal networks only and disable external exposure if operationally feasible. Within 7 days: Deploy web application firewall rules targeting malformed HTTP requests to the Forge component; enable detailed access logging and real-time alerting on all Guided Search traffic; escalate with Oracle support to confirm patch timeline and interim guidance. Within 30 days: Review historical access logs from the past 6 months for evidence of exploitation; evaluate upgrade paths to patched versions upon availability; implement application-level input validation and request signing if supported by the platform.

Oracle Commerce Guided Search CVE-2026-61154

EUVD-2026-47362 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-vhpc-3rg9-fhfp

Privilege Escalation Oracle Commerce Guided Search Platform Services

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor describes easily exploitable, unauthenticated, network HTTP takeover with full impact, so AV:N/AC:L/PR:N/UI:N and C/I/A all High; scope unchanged as no cross-component compromise is stated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:29 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search Platform Services. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search Platform Services. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Commerce Guided Search Platform Services 11.4.0 (formerly Endeca) is possible by an unauthenticated remote attacker sending crafted HTTP requests to the Forge component. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and lack of authentication make it a high-priority patch target.

Technical ContextAI

Oracle Commerce Guided Search (the product line descended from Oracle Endeca) provides faceted/guided navigation and search for large e-commerce catalogs. The affected 'Forge' component is the Endeca data-processing/pipeline engine that ingests, transforms, and indexes catalog data to build the MDEX search index. Because Oracle assigns no CWE for this entry, the precise root-cause class is unpublished, but a 9.8 vector with full C/I/A impact and 'takeover' language over HTTP is consistent with an unauthenticated deserialization, injection, or authentication-bypass flaw in an exposed Platform Services HTTP endpoint. Oracle's own tag of 'Information Disclosure' suggests confidentiality exposure is a notable facet of the impact.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); no exact patched build number is given in the input, so treat this as 'patch available per vendor advisory' and pull the specific patch for Guided Search Platform Services 11.4.0 from the CPU matrix. Until patching is complete, reduce exposure by restricting network access to the Forge/Platform Services HTTP endpoints so they are reachable only from trusted internal management hosts (place them behind a firewall/VPN or internal-only VLAN), since these components are back-end data-processing services that should never be internet-facing - the trade-off is minimal for most deployments because Platform Services is not a customer-facing tier. Avoid exposing the Endeca administrative/Forge ports (commonly in the 8000-range) to untrusted networks, and monitor those endpoints for anomalous HTTP requests as a detection compensating control.