What is the CVSS score of CVE-2026-61160?

CVE-2026-61160 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Commerce are affected by CVE-2026-61160?

Oracle Commerce Guided Search / Experience Manager 11.4.0 contains a high-severity vulnerability that exposes customer data and threatens transaction processing availability-affecting organizations…

How to fix or mitigate CVE-2026-61160?

Within 24 hours, identify all systems running Oracle Commerce Guided Search / Experience Manager 11.4.0 and implement firewall rules or network segmentation to restrict access to the affected component from untrusted sources; enable comprehensive HTTP request logging. Within 7 days, deploy web application firewall rules to detect exploitation attempts and establish 24/7 monitoring with automated alerting for suspicious access patterns or service disruptions. Within 30 days, monitor Oracle's security advisories for patch availability, evaluate the feasibility of upgrading to a patched version, and conduct a full audit of data potentially exposed through this vulnerability.

Oracle Commerce CVE-2026-61160

EUVD-2026-47368 HIGH

Improper Input Validation (CWE-20)

2026-07-21 secalert_us@oracle.com

GHSA-crx8-m6mq-3f36

Authentication Bypass Oracle Commerce Guided Search Commerce Experience Manager

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

8.1 HIGH

Network HTTP with low complexity and a required low-privilege account gives AV:N/AC:L/PR:L/UI:N; full data read is C:H and complete DoS is A:H, with no tampering so I:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:26 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 8.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H).

AnalysisAI

Sensitive data disclosure and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) let a low-privileged, network-based attacker read all data accessible to the application and hang or repeatedly crash the service over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and availability impact but no integrity impact. Disclosed in the Oracle July 2026 Critical Patch Update; no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

Oracle Commerce Guided Search (the former Endeca) with its Experience Manager module is the search, navigation, and content-merchandising layer of Oracle's enterprise e-commerce suite, typically fronted by the MDEX engine and Experience Manager web tooling exposed over HTTP. The flaw resides in the Experience Manager component of version 11.4.0. Oracle assigned no CWE (CWE: N/A), and the source tag 'Authentication Bypass' conflicts with the CVSS vector's PR:L (a privilege level is required), so the precise root-cause class cannot be confirmed from the available data; the impact profile (C:H/A:H, I:N) is consistent with an access-control or input-handling defect that exposes data and permits resource-exhaustion crashes.

RemediationAI

Apply the fixes in the Oracle July 2026 Critical Patch Update per the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle did not publish an independent point-release version number in the supplied data, so the CPU itself is the patch reference (Patch available per vendor advisory). Until patched, restrict network reachability of the Experience Manager and Guided Search HTTP endpoints to trusted management networks and known application tiers via firewall or reverse-proxy allowlisting, tighten and audit low-privilege application accounts since only a low privilege level is required, and add rate-limiting and monitoring for repeated requests that could trigger the crash - with the trade-offs that endpoint restrictions may disrupt legitimate merchandiser access to Experience Manager and rate-limiting may affect heavy catalog operations.