Oracle Commerce CVE-2026-61160

Exploitation requires network HTTP access to an Oracle Commerce Guided Search / Experience Manager instance (specifically version 11.4.0, Experience Manager component) and, per the CVSS vector's PR:L, a low-privileged authenticated account on the application - no user interaction and no elevated privileges are needed. Limiting factors: only version 11.4.0 is stated as affected, the target's Experience Manager HTTP interface must be reachable by the attacker, and a valid low-privilege credential is required unless the vendor 'Authentication Bypass' tag indicates authentication can be defeated (unconfirmed and contradicting PR:L). Integrity is not impacted, so the realistic outcome is data theft and service outage, not data tampering.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H = 8.1 High) indicates easy, network-based, low-privilege exploitation with no user interaction, meaning any authenticated low-privilege account can trigger both data disclosure and a complete DoS. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so real-world exploitation likelihood cannot be quantified - the score reflects potential severity, not observed activity. Note the conflict between the vendor 'Authentication Bypass' tag and PR:L in the vector: if authentication can in fact be bypassed, the effective privilege requirement may approach PR:N and the real risk would be higher than 8.1 suggests - verify with Oracle. As an Oracle CPU item in a specialized enterprise product, treat it as a genuine priority for organizations running Oracle Commerce, though not necessarily a mass-exploitation threat.

An attacker holding or obtaining a low-privileged Oracle Commerce account (or, if the 'Authentication Bypass' tag holds, circumventing authentication) sends crafted HTTP requests to the Experience Manager component. Because attack complexity is low and no user interaction is needed, the attacker reads all application-accessible data and then issues requests that hang or repeatedly crash the service, producing a complete denial of service. No public exploit code has been identified at time of analysis.