What is the CVSS score of CVE-2026-61158?

CVE-2026-61158 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Commerce are affected by CVE-2026-61158?

Oracle Commerce Guided Search and Experience Manager 11.4.0 contains an unauthenticated remote data disclosure vulnerability (CVSS 7.5) that allows external attackers to access customer data through…

How to fix or mitigate CVE-2026-61158?

Within 24 hours, inventory all production instances of Oracle Commerce 11.4.0, classify the sensitivity of data indexed in Guided Search, and assess network accessibility of the RMI interface from untrusted networks. Within 7 days, implement firewall rules to restrict RMI port access (typically 1099) to authorized administration networks only, enable comprehensive audit logging of RMI communications, and deploy real-time monitoring for anomalous data access patterns. Within 30 days, monitor Oracle's Critical Patch Updates for patch availability, develop an upgrade plan for deployment once released, and evaluate whether temporary service isolation is required pending vendor remediation.

Oracle Commerce CVE-2026-61158

EUVD-2026-47366 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-fgx5-wfqg-vqx8

Authentication Bypass Oracle Commerce Guided Search Commerce Experience Manager

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network access to an RMI service (AV:N/AC:L/PR:N/UI:N) yielding full data read but no write or disruption, so C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:27 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker abuse the exposed RMI interface of the Experience Manager component to read critical or all Guided Search accessible data. Scored CVSS 3.1 7.5 with confidentiality-only impact and rated 'easily exploitable' by Oracle, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Disclosed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

The affected component is Oracle Commerce (formerly the Endeca/ATG lineage) Guided Search and Experience Manager, an enterprise faceted-search and merchandising platform used behind large e-commerce storefronts. The attack surface is Java RMI (Remote Method Invocation), a binary object-serialization protocol these back-end services expose for inter-component communication; RMI endpoints are frequently reachable on the internal network and, when improperly exposed, allow unauthenticated remote interaction. No CWE was supplied (CWE: N/A), so the precise root cause class is not officially categorized, but the confidentiality-only, unauthenticated-over-RMI profile is consistent with an information-exposure or insecure-deserialization/service-exposure weakness in the Experience Manager RMI listener. The vendor tag 'Authentication Bypass' further indicates the RMI path can be reached without valid credentials.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPU entries carry the corrective patch, so identify and deploy the 11.4.0 Experience Manager patch listed there (exact patched build not enumerated in the provided data - confirm via the advisory before scheduling). Until patched, the highest-value compensating control is to restrict network reachability of the Experience Manager RMI listener: firewall or ACL the RMI port(s) so only trusted internal management hosts can connect, and ensure no RMI endpoint is exposed to the internet or untrusted VLANs (trade-off: legitimate distributed components must be explicitly allowlisted or inter-node communication will break). Place the affected services behind a segmented back-end network and monitor RMI connections for anomalous unauthenticated access as a detective control.