What is the CVSS score of CVE-2026-61157?

CVE-2026-61157 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Commerce are affected by CVE-2026-61157?

Oracle Commerce Guided Search / Experience Manager 11.4.0 contains an authentication bypass allowing unauthenticated remote attackers to access sensitive data.

How to fix or mitigate CVE-2026-61157?

Within 24 hours, inventory all systems running Oracle Commerce Guided Search or Experience Manager 11.4.0 and confirm which are network-accessible. Within 7 days, restrict network access to these systems to trusted internal networks only, deploy web application firewall rules targeting abnormal data access patterns, and enable comprehensive audit logging. Within 30 days, establish a timeline for upgrading to a patched version once Oracle releases a fix, or transition to alternative solutions if patches are delayed beyond acceptable risk windows.

Oracle Commerce CVE-2026-61157

EUVD-2026-47365 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9264-93x2-g7wp

Authentication Bypass Oracle Commerce Experience Manager Commerce Guided Search

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network HTTP access with no user interaction yields full read of restricted data but no integrity or availability impact (C:H/I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:28 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach sensitive data over HTTP, with Oracle and the EUVD entry tagging the flaw as an authentication bypass. The CVSS 3.1 base score of 7.5 reflects a high-confidentiality, no-integrity, no-availability impact, and Oracle labels it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a credible target once patch details are reverse-engineered.

Technical ContextAI

Oracle Commerce Guided Search (formerly Endeca) and its Experience Manager component power faceted search, navigation, and merchandising experiences for large e-commerce catalogs; Experience Manager is the authoring/preview surface that serves configuration and content over HTTP. The specific weakness is not assigned a CWE (listed N/A), but the 'Authentication Bypass' tag combined with a confidentiality-only impact (C:H/I:N/A:N) points to a broken or missing access-control check (CWE-287/CWE-306 class) on an HTTP-exposed Experience Manager endpoint that returns data intended to be restricted. No CPE strings were provided beyond the plain product string; the only affected build named by both Oracle and ENISA EUVD is version 11.4.0.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though the input data does not state a discrete fixed build number for 11.4.0, so confirm the exact patch/bundle level directly from the Oracle CPU matrix before deployment. Until patched, reduce exposure by restricting network access to the Experience Manager endpoints - place them behind a VPN or IP allowlist so only trusted administrative networks can reach the authoring/preview HTTP interface, and block direct internet access to Guided Search admin ports; the trade-off is that legitimate remote merchandisers lose direct access and must connect through the VPN. Additionally, front the service with a reverse proxy or WAF that enforces authentication on Experience Manager paths, accepting the risk that path-based rules may need tuning to avoid breaking legitimate preview traffic. Monitor Experience Manager HTTP logs for anomalous unauthenticated requests to configuration and content endpoints.