What is the CVSS score of CVE-2026-61159?

CVE-2026-61159 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Commerce are affected by CVE-2026-61159?

Oracle Commerce Guided Search / Experience Manager 11.4.0 contains a critical data-disclosure vulnerability (CVE-2026-61159, CVSS 7.5) that allows unauthenticated remote attackers to access sensitive…

How to fix or mitigate CVE-2026-61159?

Within 24 hours: Inventory all systems running Oracle Commerce 11.4.0 and assess network exposure; implement immediate access controls such as firewall rules, IP whitelisting, and network segmentation to restrict connectivity to trusted sources only. Within 7 days: Contact Oracle support for mitigation guidance and patch timeline; evaluate the operational impact of temporarily disabling the affected component if containment cannot be assured. Within 30 days: Deploy a vendor-released patch when available from Oracle; if no patch is released by day 30, implement compensating controls such as Web Application Firewall (WAF) rules to block data exfiltration, enhanced access logging, and continuous monitoring of query patterns.

Oracle Commerce CVE-2026-61159

EUVD-2026-47367 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-cfw5-gwq3-hvq4

Authentication Bypass Oracle Information Disclosure Commerce Experience Manager Commerce Guided Search

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network HTTP access (AV:N/PR:N/AC:L) yields full read of accessible data (C:H) with no integrity or availability impact, matching an authentication-bypass disclosure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:26 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 lets a remote, unauthenticated attacker read all data accessible to the Experience Manager component over HTTP. Oracle rates it CVSS 7.5 with high confidentiality impact and no integrity or availability effect, and the reporter tags it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, no-privilege profile makes it a straightforward information-disclosure risk.

Technical ContextAI

Oracle Commerce Guided Search (the former Endeca product line) and its Experience Manager content-authoring module power faceted search, navigation, and merchandising experiences for enterprise e-commerce sites. The flagged component is Experience Manager, which manages page/content configuration served over HTTP. The reporter's 'Authentication Bypass' tag points to a class where access-control checks on this component can be circumvented (broadly CWE-287/CWE-306 territory), letting a request reach protected data without a valid session. No CWE was assigned in the source data, so the precise weakness class is inferred from the tag and the confidentiality-only CVSS profile rather than confirmed.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor advisory covering this CVE; consult that CPU matrix for the exact patch/bundle applicable to Guided Search / Experience Manager 11.4.0, as no discrete fixed version string was published in the available data (Patch available per vendor advisory). Until patched, restrict network access to the Experience Manager component-place it behind a VPN or internal network segment and block direct Internet exposure of its HTTP endpoints, and use a reverse proxy or WAF to require authentication in front of the component; the trade-off is that legitimate remote authoring/administration must then traverse the controlled path, which may disrupt distributed content teams. Monitor Experience Manager access logs for anonymous requests to protected content paths as a detection compensating control.