What is the CVSS score of CVE-2026-61164?

CVE-2026-61164 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Commerce Experience Manager are affected by CVE-2026-61164?

Oracle Commerce Guided Search / Experience Manager 11.4.0 contains an authentication bypass allowing remote unauthenticated attackers to fully compromise the Content Acquisition System's…

How to fix or mitigate CVE-2026-61164?

Within 24 hours, identify all systems running Oracle Commerce Guided Search / Experience Manager 11.4.0 and assess whether the Content Acquisition System is reachable from the internet or untrusted networks. Immediately restrict network access to the CMS to internal-only connectivity, and enable detailed audit logging on all data access and modification events. Within 7 days, disable the Content Acquisition System module if operationally feasible, and review recent data access logs for signs of compromise. Within 30 days, monitor Oracle's security advisories for patch releases and develop a formal remediation plan, identifying upgrade paths or alternative solutions if patching is delayed.

Commerce Experience Manager CVE-2026-61164

EUVD-2026-47372 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-fh33-cgjq-wrq9

Authentication Bypass Oracle Commerce Experience Manager Commerce Guided Search

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:24 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.4

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach the Content Acquisition System over HTTPS and read, create, modify, or delete all data accessible to the product. The 'Authentication Bypass' tagging combined with PR:N in the CVSS vector indicates the flaw defeats access controls without credentials, though the high attack complexity (AC:H) means exploitation is non-trivial. No public exploit identified at time of analysis and the issue is not in CISA KEV; it was disclosed by Oracle in the July 2026 Critical Patch Update.