What is the CVSS score of EUVD-2026-47355?

EUVD-2026-47355 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Oracle Commerce EUVD-2026-47355

| CVE-2026-61147 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-46c8-26j9-x4qx

Denial Of Service Oracle Commerce Guided Search Commerce Experience Manager

6.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local OS logon required to reach the CAS component (AV:L); no elevated privileges needed beyond that logon (PR:N); impact is availability-only denial of service with no confidentiality or integrity exposure.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:19 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service via the Content Acquisition System component in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows any local user already logged onto the host infrastructure to crash or hang the application without requiring elevated OS privileges. Disclosed in Oracle's July 2026 Critical Patch Update, the CVSS 3.1 score of 6.2 (Medium) reflects the local-only attack vector, which substantially constrains exposure to insider threats or attackers who have already achieved OS-level foothold. No public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.

Technical ContextAI

Oracle Commerce Guided Search (formerly Oracle Endeca Guided Search) and Experience Manager form an enterprise e-commerce search and merchandising platform; the Content Acquisition System (CAS) is the data ingestion and indexing subsystem responsible for processing and loading product catalog data. The CVSS vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H places the exploitable surface at the local OS level with no special attack complexity. No CWE is specified by Oracle, so the precise root-cause class - whether a resource exhaustion flaw, unchecked loop, or similar - remains unconfirmed from available intelligence. The affected version is confirmed as 11.4.0 by Oracle's CPU advisory and ENISA EUVD-2026-47355.

RemediationAI

Apply the patches provided in Oracle's July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact fixed version number is not identified in the available intelligence - consult the Oracle CPU advisory directly to obtain the specific patched build for Commerce Guided Search / Experience Manager 11.4.0. As a compensating control pending patching, restrict OS-level logon access to Commerce infrastructure nodes to the absolute minimum necessary service and administrative accounts; this directly blocks the AV:L attack vector since no local session means no exploitation path. Audit and remove unnecessary local user accounts on Commerce server hosts to further reduce insider-threat and lateral-movement risk. Note that restricting logon access may require coordinating with deployment and operations teams and could affect legitimate administrative workflows.