EUVD-2026-61900
GHSA-r96c-fqgg-hpcp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Commerce Platform TCP port
-
DeliverySend crafted request to Dynamo framework
-
ExploitTrigger unauthenticated compromise
-
ExecutionGain full platform control
-
ImpactExfiltrate data or disrupt service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against Oracle Commerce Platform 11.4.0 (Dynamo Application Framework), per CVSS AV:N/AC:L/PR:N/UI:N. The only prerequisite is network TCP reachability to the affected Commerce Platform service; no credentials, no specific non-default feature toggle, and no user interaction are required according to the vector and Oracle's description. Limiting factors that reduce real-world exposure: the instance must be network-reachable by the attacker (internet-facing instances are at highest risk; those isolated behind segmentation/VPN/WAF are less exposed), and only supported version 11.4.0 is confirmed affected - deployments on other branches are not confirmed vulnerable from this data. |
| Impact | All available severity signals point the same direction: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a network-reachable, low-complexity, unauthenticated attack yielding full system compromise - the highest-risk profile short of a scope change. This is a genuine priority, not a high-CVSS-but-low-real-risk case, because there are no mitigating prerequisites in the vector. That said, some real-world-exploitation signals are absent or unavailable: EPSS score was not provided, the vulnerability is not in CISA KEV (no confirmed active exploitation), and no POC/exploit code has been identified at time of analysis. Oracle CPU advisories do not publish SSVC decision data. The residual uncertainty is about likelihood/timeline of exploitation, not about impact: given Oracle CPU flaws are frequently reverse-engineered from patches, defenders should treat the exploitation window as opening now even though no weaponized exploit is yet public. |
| Exploit ScenarioDerived | An attacker who can reach the Oracle Commerce Platform's TCP service over the network sends a crafted request to the Dynamo Application Framework and, with no credentials and no user interaction, gains full control of the platform - reading customer and payment data, altering storefront behavior, or taking the application offline. Because attack complexity is low and no authentication is required, exploitation can be scripted and repeated against any exposed instance. No public POC is identified at time of analysis, but the low barrier makes independent exploit development straightforward once patch details are analyzed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Remote takeover in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with only TCP network access to fully compromise the platform. Rated CVSS 9.8 with complete confidentiality, integrity and availability loss, the flaw requires no authentication or user interaction, making it a top-tier remediation priority. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and total-compromise impact warrant immediate patching via Oracle's August 2026 Critical Patch Update.
RemediationAI
Apply the fix from Oracle's Critical Patch Update of August 2026 (https://www.oracle.com/security-alerts/cspuaug2026.html); Patch available per vendor advisory, though the input does not specify an exact patched build number, so identify the precise patch/bundle for Commerce Platform 11.4.0 within the CPU. Because the exact fix version is not provided in the input data, do not assume a version - pull it from the Oracle CPU patch availability table. As compensating controls until patching completes: restrict network reachability of the Commerce Platform / Dynamo application server so the affected TCP listener is not exposed to untrusted networks or the internet (front it behind a WAF and IP allow-listing), since the attack vector is network-based and unauthenticated - trade-off is potential disruption to legitimate integrations that must be explicitly allow-listed. Increase monitoring on the DAF request pipeline and application logs for anomalous requests, and place the storefront behind a reverse proxy that terminates and inspects traffic. These controls reduce exposure but are not a substitute for the vendor patch given the 9.8 severity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Commerce Platform (formerly ATG Web Commerce) is a Java-based enterprise e-commerce suite. The affected component is the Dynamo Application Framework - the core runtime that provides the Nucleus component/dependency-injection container, request-handling pipeline (DAF), and session/repository services on which the storefront and commerce applications run. Because the flaw sits in this foundational framework rather than a peripheral module, a successful exploit reaches the heart of the application server. Oracle did not assign a CWE (CWE: N/A) and the advisory withholds technical specifics per Oracle's standard CPU disclosure practice, so the precise root-cause class (e.g., deserialization, injection, or authentication bypass) cannot be confirmed from the available data; however, the CVSS vector (network, low complexity, no privileges, no interaction, resulting in full C/I/A compromise) is consistent with an unauthenticated remote code execution or equivalent takeover primitive.
Know when Commerce Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle confirms unauthenticated network TCP access with easy exploitation and full platform takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H; scope unchanged within the application server.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Commerce Platform 11.4.0 can be remotely compromised by unauthenticated attackers through a critical vulnerability (CVSS 9.8) requiring only TCP network access and no user interaction-directly threatening the confidentiality and integrity of customer data and e-commerce operations. Although no public exploit has been identified at time of analysis, the simplicity of attack and totality of potential compromise warrant immediate remediation to prevent revenue loss and regulatory exposure. Organizations running affected versions face significant risk of unauthorized access, data theft, and operational disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Commerce Platform
View allA Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Ra
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. Rated high seve
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated at
Full system takeover of Oracle Commerce Platform 11.4.0 is possible when a remote, unauthenticated attacker reaches the
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated at
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Rate
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "
Exploit-DB