What is the CVSS score of CVE-2026-61162?

CVE-2026-61162 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Oracle Commerce are affected by CVE-2026-61162?

Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller) contains a privilege escalation vulnerability allowing low-privileged local users to read, create, modify, or…

How to fix or mitigate CVE-2026-61162?

Within 24 hours: Identify and document all systems running Oracle Commerce Guided Search / Experience Manager 11.4.0 and inventory their data scope and user population. Within 7 days: Restrict local system access to the product to only essential personnel, enforce principle of least privilege, and enable detailed audit logging for all local account activity and data operations. Within 30 days: Monitor Oracle Critical Patch Update advisories for security patches to version 11.4.0; develop and test a migration plan to current supported versions; implement anomaly detection on local logon and data access patterns.

Oracle Commerce CVE-2026-61162

EUVD-2026-47370 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-mww4-9h5v-w23r

Authentication Bypass Oracle Commerce Experience Manager Commerce Guided Search

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.1 HIGH

Requires local logon with low privileges (AV:L/PR:L), low complexity and no interaction; full read/write to data yields C:H/I:H, with no availability impact (A:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:25 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller) allows a low-privileged local attacker with logon access to read, create, modify, or delete all data accessible to the product. The flaw carries a CVSS 3.1 base score of 7.1 (C:H/I:H, no availability impact) and is described by Oracle as 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it was disclosed in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

The affected component is the Endeca Application Controller (EAC), the management and provisioning layer of Oracle Commerce Guided Search (formerly Endeca), a faceted search and merchandising engine used to power product discovery on e-commerce sites. The EAC coordinates indexing (Forge/Dgraph/MDEX engine operations), deployment, and administrative provisioning tasks, typically over its own management services on the application infrastructure host. No CWE was assigned by NVD; the reporter tag labels this an 'Authentication Bypass,' but the CVSS metrics (PR:L, local vector) instead indicate that an already-authenticated low-privileged local principal escalates to full read/write over the product's data domain rather than bypassing authentication from an unauthenticated position. This discrepancy should be treated cautiously - see risk assessment.

RemediationAI

Apply the fixes bundled in the Oracle Critical Patch Update of July 2026 as documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle CPUs deliver the patch as a bundled quarterly release rather than a distinct version tag, so treat 'apply the July 2026 CPU for Oracle Commerce Guided Search 11.4.0' as the primary fix (no standalone fixed version number was provided in the source data, so do not assume one). Until the CPU is applied, reduce exposure by restricting interactive/logon access to the hosts running the Endeca Application Controller to a minimal set of trusted administrators, tightening OS-level accounts and removing unnecessary low-privilege local logins (side effect: may disrupt operators or automation that legitimately log on to the EAC host), and by network-segmenting the Endeca management infrastructure away from general user access. Because the vector is local (AV:L), host access controls are the most effective compensating control while patching is scheduled.