What is the CVSS score of CVE-2026-61155?

CVE-2026-61155 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Commerce Guided Search are affected by CVE-2026-61155?

Oracle Commerce Guided Search Platform Services 11.4.0 contains a critical, unpatched vulnerability permitting unauthenticated remote attackers to exfiltrate all service-accessible data and execute…

How to fix or mitigate CVE-2026-61155?

Within 24 hours, inventory all systems running Oracle Commerce Guided Search Platform Services 11.4.0 and assess their network exposure; isolate non-critical instances if operationally feasible. Within 7 days, implement network segmentation to restrict access to the Guided Search service to trusted internal sources only, configure Web Application Firewall rules to detect and block crafted HTTP requests targeting the vulnerability, and enable comprehensive logging of all access attempts to the service. Within 30 days, establish active monitoring of Oracle's advisory channels for patch releases, complete a business-case analysis for upgrading or migration to alternative search solutions, and maintain heightened security monitoring and alerting for exploitation indicators until a vendor patch becomes available.

Oracle Commerce Guided Search CVE-2026-61155

EUVD-2026-47363 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-g3h5-5773-fh44

Authentication Bypass Oracle Commerce Guided Search Platform Services

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated (auth-bypass tag supports PR:N) low-complexity HTTP access yields full data read (C:H) and complete DOS (A:H) with no tampering (I:N), matching the 9.1 score.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:28 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search Platform Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search Platform Services accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search Platform Services. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).

AnalysisAI

Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a remote attacker send crafted HTTP requests to read all data accessible to the service and to crash or hang it completely. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and availability impact and no integrity impact; disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the combination of network reachability, no authentication, and low complexity makes it an urgent patch priority.

Technical ContextAI

Oracle Commerce Guided Search Platform Services is the search and navigation engine descended from Oracle's Endeca product line, used to power faceted/guided search on e-commerce storefronts. The affected component, Forge, is the Endeca data-processing pipeline (the Data Foundry) responsible for ingesting, transforming, and indexing catalog records into the MDEX engine, typically driven over HTTP-based service endpoints. Oracle did not assign a CWE (CWE: N/A) and the advisory text is deliberately sparse, but the vendor-supplied tag 'Authentication Bypass' together with the vector (no privileges, high confidentiality impact) points to a missing or broken access-control check on a network-facing service endpoint that also permits resource exhaustion. Only version 11.4.0 is called out as affected by both the CVE description and the ENISA EUVD record (EUVD-2026-47363).

RemediationAI

Apply the fix from the Oracle July 2026 Critical Patch Update at https://www.oracle.com/security-alerts/cpujul2026.html - Oracle delivers these as quarterly CPU patches for Oracle Commerce Guided Search / Endeca rather than as a new marketing version, so identify and deploy the CPU patch that covers CVE-2026-61155 for the 11.4.0 platform (exact fixed build not independently confirmed from the provided data; treat the CPU bundle as the release). Until patched, reduce exposure with concrete compensating controls: place the Guided Search Platform Services and Forge endpoints behind network segmentation or a firewall so they are reachable only from trusted application-tier hosts (trade-off: verify legitimate storefront/indexing traffic paths first to avoid breaking search updates); restrict HTTP access to the service ports via ACLs or a reverse proxy that enforces authentication in front of the endpoint (trade-off: proxy must not block the Forge pipeline's own service calls); and monitor for anomalous requests and service crashes/hangs as an early indicator of the DOS impact. Because integrity is not affected (I:N), controls should prioritize confidentiality (data exfiltration) and availability (crash/hang) protection.