What is the CVSS score of CVE-2026-61163?

CVE-2026-61163 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Commerce Experience Manager are affected by CVE-2026-61163?

Oracle Commerce Guided Search and Experience Manager version 11.4.0 is vulnerable to complete system takeover by unauthenticated remote attackers over HTTP, affecting confidentiality, integrity, and…

How to fix or mitigate CVE-2026-61163?

Within 24 hours, identify and audit all systems running Oracle Commerce Guided Search/Experience Manager 11.4.0 and immediately restrict network access from untrusted networks. Within 7 days, implement network segmentation to limit external access, deploy web application firewall (WAF) rules to filter HTTP traffic targeting vulnerable endpoints, and evaluate disabling or restricting Guided Search and Experience Manager components if operationally feasible. Within 30 days, initiate and plan execution of an upgrade to the latest available version of Oracle Commerce and establish monitoring and logging to detect exploitation attempts pending vendor patches.

Commerce Experience Manager CVE-2026-61163

EUVD-2026-47371 HIGH

Improper Authentication (CWE-287)

2026-07-21 secalert_us@oracle.com

GHSA-mwf4-9868-mhgc

Oracle Authentication Bypass Commerce Experience Manager Commerce Guided Search

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:25 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Forge component) lets an unauthenticated remote attacker compromise confidentiality, integrity and availability over HTTP, per Oracle's CVSS 3.1 8.1 rating. Exploitation is rated high-complexity (AC:H), so it requires specific conditions or timing rather than a trivial single request. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.