What is the CVSS score of CVE-2026-61161?

CVE-2026-61161 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Commerce are affected by CVE-2026-61161?

Oracle Commerce Guided Search / Experience Manager 11.4.0 contains a critical remote code execution vulnerability in the unauthenticated Endeca Application Controller that permits complete system…

How to fix or mitigate CVE-2026-61161?

Within 24 hours: identify all systems running Oracle Commerce Guided Search / Experience Manager 11.4.0 and immediately restrict HTTP access to the Endeca Application Controller to administrative networks only via firewall rules or network segmentation. Within 7 days: deploy Web Application Firewall (WAF) rules to block attack traffic targeting the Application Controller, enable detailed HTTP access logging, and contact Oracle for patch status and interim workarounds. Within 30 days: evaluate migration to Oracle Commerce version 12.x or alternative e-commerce platforms, establish comprehensive monitoring for indicators of compromise, and document findings for remediation tracking.

Oracle Commerce CVE-2026-61161

EUVD-2026-47369 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-98xh-6375-3c4m

Oracle Authentication Bypass Commerce Experience Manager Commerce Guided Search

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easily exploitable, unauthenticated HTTP access to the controller yielding full takeover, so AV:N/AC:L/PR:N/UI:N with high C/I/A.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:26 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Controller, which an unauthenticated attacker can reach over HTTP to fully compromise the product. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV, but its network-facing, no-authentication profile makes it a high-priority patch item.

Technical ContextAI

Oracle Commerce (formerly Endeca) Guided Search and Experience Manager provide faceted search, navigation, and merchandising experiences for e-commerce sites. The affected component, the Endeca Application Controller (EAC), is the central management service that provisions, deploys, and controls Endeca application components (dgraphs, forge/indexing pipelines, and related processes) over an HTTP/web-service interface. Because EAC exposes administrative control of the Endeca application stack over the network, a defect reachable through its HTTP interface translates directly into control of the application. Oracle did not assign a CWE (listed as N/A), so the precise root-cause class (for example authentication bypass, deserialization, or command/XML injection) is not confirmed from the available data; the 'takeover' language and full CIA impact are consistent with unauthenticated administrative access or remote code execution against the controller.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026, which is the advisory that discloses this issue (https://www.oracle.com/security-alerts/cpujul2026.html); consult that CPU matrix for the exact patch/bundle applicable to Oracle Commerce Guided Search / Experience Manager 11.4.0, as the input does not state a specific fixed version number and no version should be invented. Because the vulnerable component is the Endeca Application Controller and the attack is unauthenticated over HTTP, the highest-value compensating control until patching is network isolation: restrict access to the EAC HTTP port so it is reachable only from trusted management hosts (host/network ACLs or firewall rules), remove any internet exposure, and place it behind a VPN or bastion - the trade-off is that legitimate remote administration and any integrations calling the controller must be added to the allowlist. Additionally, front the interface with a reverse proxy enforcing authentication and monitor EAC access logs for anomalous provisioning/deployment requests. Patch status: released patched version not independently confirmed from the provided data beyond the July 2026 CPU reference - verify the exact fix in the Oracle advisory.