Oracle Commerce CVE-2026-61159

Exploitation requires network reachability to the HTTP interface of the Oracle Commerce Experience Manager component on version 11.4.0; no authentication, privileges, or user interaction are needed (PR:N/UI:N/AC:L), consistent with the reporter's authentication-bypass tag. The primary limiting factor is exposure: the Experience Manager endpoint must be reachable by the attacker, so deployments that keep it on an internal/segmented network behind authentication proxies substantially reduce real-world exploitability. Impact is confined to reading data (C:H, I:N/A:N)-an attacker cannot modify content or cause outages through this flaw alone.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) describes an easily exploitable, network-reachable, unauthenticated read-only exposure: high confidentiality impact but no integrity or availability loss. That ceiling on impact is why the score is High rather than Critical. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation-probability and automatability signals are simply unknown rather than low. The combination of PR:N/AC:L plus an authentication-bypass tag means the technical bar is low; the main uncertainty is real-world exposure of Experience Manager endpoints to untrusted networks. Treat as a genuine prioritize-for-patching item for anyone running 11.4.0, while noting exploitation prevalence is unconfirmed.

An attacker who can reach the Experience Manager HTTP interface sends crafted requests that bypass authentication and enumerate or retrieve content and configuration data the component can access, exfiltrating sensitive merchandising, catalog, or customer-facing data without any credentials or user interaction. Because AC:L and PR:N apply, this requires only network reachability and no special timing or victim action. No public proof-of-concept was identified at time of analysis.