What is the CVSS score of CVE-2026-61165?

CVE-2026-61165 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Commerce are affected by CVE-2026-61165?

Oracle Commerce Guided Search Platform Services 11.4.0 contains a remote denial-of-service and information disclosure vulnerability (CVE-2026-61165, CVSS 7.1) that allows network-adjacent attackers…

How to fix or mitigate CVE-2026-61165?

Within 24 hours: Identify all systems running Oracle Commerce Guided Search 11.4.0 and assess their network exposure; enable comprehensive HTTP request logging for the affected component and restrict access to authenticated users only via network segmentation or WAF rules. Within 7 days: Deploy compensating controls including DDoS detection signatures and rate limiting on search endpoints, implement database access controls to minimize data exposure scope, and establish continuous monitoring for service crashes and performance anomalies. Within 30 days: Contact Oracle support for patch release timelines; prepare upgrade procedures to Oracle Commerce 11.4.1 or later once available; conduct security testing on patched versions before production deployment.

Oracle Commerce CVE-2026-61165

EUVD-2026-47373 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-9x53-q277-9vpf

Information Disclosure Oracle Commerce Guided Search Platform Services

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

vuln.today AI

7.1 HIGH

Network HTTP reachable and easily exploitable (AV:N/AC:L) but requires a low-privileged account (PR:L); dominant complete-DoS drives A:H, with limited data read (C:L) and no integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:23 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search Platform Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search Platform Services and unauthorized read access to a subset of Oracle Commerce Guided Search Platform Services accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H).

AnalysisAI

Denial-of-service and information disclosure in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a low-privileged, network-adjacent attacker send crafted HTTP requests to hang or repeatedly crash the service (complete DoS) and read a subset of accessible data. The flaw is rated CVSS 3.1 7.1 and was disclosed by Oracle in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle characterizes it as easily exploitable.

Technical ContextAI

Oracle Commerce Guided Search (formerly Oracle Endeca / ATG Guided Search) is an enterprise faceted-search and product-discovery platform used in e-commerce storefronts. The affected component, Forge, is the Endeca Information Transformation Layer (data ingest/processing pipeline) within Platform Services. The advisory does not assign a CWE (CWE: N/A), but the reported behavior - an authenticated HTTP request causing a hang or repeatable crash plus partial data exposure - is consistent with an uncontrolled-resource-consumption or improper-input-handling class of defect (e.g., CWE-400/CWE-20). The mixed impact (A:H with C:L) suggests a request-parsing or processing path that both leaks a limited data subset and exhausts/terminates the service.

RemediationAI

Apply the fix from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though an exact fixed build/patch number is not enumerated in the provided data, so consult the CPU matrix for the precise Guided Search Platform Services patch. Because exploitation requires low privileges over HTTP, compensating controls until patching include restricting network access to the Platform Services / Forge HTTP endpoints to trusted management hosts only (network ACLs or firewall rules), placing the service behind authenticated reverse-proxy/WAF rate limiting to blunt the DoS vector, and tightening the low-privilege accounts that can reach the service; the trade-off is that these controls reduce exposure but do not eliminate risk from insiders or compromised low-privilege accounts, and aggressive rate limiting may affect legitimate data-ingest jobs.