What is the CVSS score of CVE-2026-61165?

CVE-2026-61165 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-61165?

Within 24 hours: Identify all systems running Oracle Commerce Guided Search 11.4.0 and assess their network exposure; enable comprehensive HTTP request logging for the affected component and restrict access to authenticated users only via network segmentation or WAF rules. Within 7 days: Deploy compensating controls including DDoS detection signatures and rate limiting on search endpoints, implement database access controls to minimize data exposure scope, and establish continuous monitoring for service crashes and performance anomalies. Within 30 days: Contact Oracle support for patch release timelines; prepare upgrade procedures to Oracle Commerce 11.4.1 or later once available; conduct security testing on patched versions before production deployment.

Oracle Commerce CVE-2026-61165

EUVD-2026-47373 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-9x53-q277-9vpf

Information Disclosure Oracle Commerce Guided Search Platform Services

7.1

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-privileged HTTP access
Exploit

Send crafted request to Forge endpoint
Execution

Trigger resource hang or crash
Impact

Cause complete DoS and read data subset

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires network access to the Oracle Commerce Guided Search Platform Services HTTP interface and a low-privileged authenticated account (CVSS PR:L), with no user interaction (UI:N). The exact affected feature is the Forge component of Platform Services in version 11.4.0. Limiting factors: an attacker must already hold at least low-level credentials/access to the service, and only version 11.4.0 is confirmed affected - so exposure is bounded by how reachable the Forge/Platform Services HTTP endpoint is and by control over low-privilege accounts. This is not remote-unauthenticated; the PR:L requirement is the primary constraint.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with the dominant impact being availability (complete DoS) plus limited confidentiality loss and no integrity impact. Oracle explicitly labels it 'easily exploitable,' reinforcing the AC:L/low-effort assessment. However, EPSS is not provided, there is no KEV listing, and no public POC is identified - so real-world exploitation pressure is currently unquantified and appears speculative rather than active. No SSVC decision data is supplied. Net: a genuine priority for internet-exposed or shared-tenant Guided Search deployments given the DoS potential and low bar, but the absence of active-exploitation and EPSS signals means this is a patch-in-normal-cycle item rather than an emergency unless the service is externally exposed.
Exploit ScenarioDerived	A low-privileged user (or an attacker who has obtained low-level credentials) sends specially crafted HTTP requests to the Guided Search Platform Services Forge endpoint, causing the service to hang or repeatedly crash and taking the storefront's search/discovery capability offline while also reading a limited subset of accessible data. No user interaction is required and Oracle rates it easily exploitable, though no public exploit code is identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Denial-of-service and information disclosure in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a low-privileged, network-adjacent attacker send crafted HTTP requests to hang or repeatedly crash the service (complete DoS) and read a subset of accessible data. The flaw is rated CVSS 3.1 7.1 and was disclosed by Oracle in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle characterizes it as easily exploitable.

RemediationAI

Apply the fix from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though an exact fixed build/patch number is not enumerated in the provided data, so consult the CPU matrix for the precise Guided Search Platform Services patch. Because exploitation requires low privileges over HTTP, compensating controls until patching include restricting network access to the Platform Services / Forge HTTP endpoints to trusted management hosts only (network ACLs or firewall rules), placing the service behind authenticated reverse-proxy/WAF rate limiting to blunt the DoS vector, and tightening the low-privilege accounts that can reach the service; the trade-off is that these controls reduce exposure but do not eliminate risk from insiders or compromised low-privilege accounts, and aggressive rate limiting may affect legitimate data-ingest jobs.

Affected VersionsENISA

Oracle Commerce Guided Search Platform Services 11.4.0

Affected Packages

euvd oracle_commerce_guided_search_platform_services no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle Commerce Guided Search (formerly Oracle Endeca / ATG Guided Search) is an enterprise faceted-search and product-discovery platform used in e-commerce storefronts. The affected component, Forge, is the Endeca Information Transformation Layer (data ingest/processing pipeline) within Platform Services. The advisory does not assign a CWE (CWE: N/A), but the reported behavior - an authenticated HTTP request causing a hang or repeatable crash plus partial data exposure - is consistent with an uncontrolled-resource-consumption or improper-input-handling class of defect (e.g., CWE-400/CWE-20). The mixed impact (A:H with C:L) suggests a request-parsing or processing path that both leaks a limited data subset and exhausts/terminates the service.

Know when Commerce Guided Search Platform Services gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

vuln.today AI 7.1 HIGH

Network HTTP reachable and easily exploitable (AV:N/AC:L) but requires a low-privileged account (PR:L); dominant complete-DoS drives A:H, with limited data read (C:L) and no integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search Platform Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search Platform Services and unauthorized read access to a subset of Oracle Commerce Guided Search Platform Services accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H).

Executive ViewAI

Why It Matters

Oracle Commerce Guided Search Platform Services 11.4.0 contains a remote denial-of-service and information disclosure vulnerability (CVE-2026-61165, CVSS 7.1) that allows network-adjacent attackers with low privileges to crash the search service or access sensitive business data through crafted HTTP requests. Organizations operating this platform face operational downtime and data exposure risks; leadership should prioritize immediate inventory and mitigation pending vendor patch availability.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: network segmentation limiting attacker access to the service, Web Application Firewall rules to filter malicious HTTP patterns, real-time monitoring and alerting for service crashes, database access controls restricting query scope to reduce information disclosure, and aggressive rate limiting on search endpoints to mitigate denial-of-service impact.

Threat Intelligence Overview

EPSS Score

0.4%

Top 71% exploitable

Prevalence

Low

niche enterprise e-commerce search platform (formerly Endeca), limited footprint

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +36

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.