What is the CVSS score of EUVD-2026-47345?

EUVD-2026-47345 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Commerce Platform are affected by EUVD-2026-47345?

Oracle Commerce Platform 11.4.0 is vulnerable to data tampering and partial service disruption via internet-accessible endpoints without requiring authentication, directly threatening transactional…

How to fix or mitigate EUVD-2026-47345?

Within 24 hours, identify and inventory all Oracle Commerce Platform 11.4.0 instances and their network accessibility; immediately restrict HTTP/HTTPS access to the platform to known trusted source IP addresses only and implement continuous logging of all access attempts. Within 7 days, deploy Web Application Firewall (WAF) rules to block suspicious data modification requests, establish database-level audit logging for insert/update/delete operations on critical tables, and baseline integrity of transactional data for anomaly detection. Within 30 days, contact Oracle support to confirm patch availability and timelines, evaluate upgrade options to patched platform versions, and develop a comprehensive migration plan off Oracle Commerce Platform 11.4.0.

Commerce Platform EUVD-2026-47345

| CVE-2026-61136 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-q3qp-4hq5-mr52

Denial Of Service Oracle Authentication Bypass Commerce Platform

7.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:37 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.3

DescriptionCVE.org

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Platform accessible data as well as unauthorized read access to a subset of Oracle Commerce Platform accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Commerce Platform. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Unauthenticated data tampering and partial denial of service in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework) allows a remote attacker to reach the platform over HTTP and, without any credentials, perform unauthorized insert/update/delete on some accessible data, read a subset of accessible data, and partially disrupt availability. Oracle rates it easily exploitable with a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.