EUVD-2026-61983
GHSA-5pxc-m8gx-mp6h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated HTTP-reachable authentication bypass gives AV:N/AC:L/PR:N/UI:N; full read and write to app data sets C:H/I:H, with no service disruption so A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Unauthenticated data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote attacker read and modify all data accessible to the application over HTTP without any credentials. Tagged as an authentication bypass, the flaw yields high confidentiality and integrity impact (CVSS 9.1) but no availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network HTTP access to a running Oracle Commerce Guided Search / Experience Manager 11.4.0 instance with the Experience Manager component exposed; no authentication, credentials, user interaction, or special client-side setup are needed (PR:N/UI:N), consistent with the 'Authentication Bypass' tag. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals align toward genuine priority: CVSS 9.1 with AV:N/AC:L/PR:N/UI:N describes trivial, unauthenticated, network-reachable exploitation, and Oracle itself characterizes it as 'easily exploitable.' Working against immediate panic, there is no EPSS score supplied, no proof-of-concept referenced, and no CISA KEV listing - so there is currently no evidence of active or widespread exploitation, and the risk is theoretical-but-severe rather than confirmed-in-use. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: apply the fixes delivered in Oracle's August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html); the input does not include a specific fixed build number, so consult the CPU matrix for the exact patch level for Commerce Guided Search 11.4.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems running Oracle Commerce Guided Search / Experience Manager 11.4.0; immediately review access logs for suspicious external queries; implement Web Application Firewall rules blocking unauthenticated HTTP requests to the vulnerable endpoints, and if operationally feasible, take the affected component offline. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today