Commerce Guided Search CVE-2026-61164

Oracle Commerce Guided Search / Experience Manager 11.4.0 contains an authentication bypass allowing remote unauthenticated attackers to fully compromise the Content Acquisition System's data-reading, modifying, or deleting all stored information. Organizations running this version have no access control protection, regardless of network position. Immediate network isolation and upgrade planning are critical.

Within 24 hours, identify all systems running Oracle Commerce Guided Search / Experience Manager 11.4.0 and assess whether the Content Acquisition System is reachable from the internet or untrusted networks. Immediately restrict network access to the CMS to internal-only connectivity, and enable detailed audit logging on all data access and modification events. Within 7 days, disable the Content Acquisition System module if operationally feasible, and review recent data access logs for signs of compromise. Within 30 days, monitor Oracle's security advisories for patch releases and develop a formal remediation plan, identifying upgrade paths or alternative solutions if patching is delayed.

Network segmentation to restrict Content Acquisition System access to internal networks only; Web Application Firewall rules to detect abnormal data access patterns; disabling the CAS module if not operationally required; continuous audit logging and monitoring of all data access, modifications, and deletions; regular review of access logs for indicators of unauthorized activity.