What is the CVSS score of EUVD-2026-47364?

EUVD-2026-47364 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Commerce Guided Search are affected by EUVD-2026-47364?

Oracle Commerce Guided Search Platform Services 11.4.0 contains a critical unauthenticated vulnerability that permits remote attackers to read, create, modify, or delete all data accessible to the…

How to fix or mitigate EUVD-2026-47364?

Within 24 hours: Isolate Oracle Commerce Guided Search Platform Services 11.4.0 from internet-facing access using firewall rules, network segmentation, or VPN-only access; alert legal and compliance teams of potential data exposure; begin inventory of all data stored in this system. Within 7 days: Deploy a Web Application Firewall with rules to detect and block exploitation attempts targeting the Guided Search component; enable comprehensive audit logging of all data access and modifications; evaluate whether the Forge component can be disabled or replaced entirely. Within 30 days: Contact Oracle Support to request timeline and expedited patch for CVE-2026-61156; conduct forensic audit of access logs since deployment to identify unauthorized data modification or exfiltration; prepare comprehensive incident summary documenting all interim controls and findings for regulatory filing if required.

Oracle Commerce Guided Search EUVD-2026-47364

| CVE-2026-61156 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-x7qw-hr43-c7jx

Authentication Bypass Oracle Commerce Guided Search Platform Services

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated HTTPS-reachable authentication bypass (AV:N/AC:L/PR:N/UI:N) yielding full read and write to service data (C:H/I:H) with no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:28 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Commerce Guided Search Platform Services. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search Platform Services accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search Platform Services accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated data compromise in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) allows remote attackers over HTTPS to read, create, modify, or delete all data accessible to the service without any credentials. Oracle rates this CVSS 9.1 with high confidentiality and integrity impact and characterizes it as 'easily exploitable,' and the intelligence tags flag an authentication-bypass class issue. No public exploit code has been identified and it is not listed in CISA KEV at time of analysis.

Technical ContextAI

Oracle Commerce Guided Search (formerly Endeca) is an enterprise faceted-search and product-discovery platform used in e-commerce storefronts; the affected 'Forge' component is part of the Endeca CAS/MDEX data-processing pipeline that ingests, transforms, and indexes catalog content for the Platform Services layer. The 'Authentication Bypass' tag combined with the CVSS PR:N metric indicates the flaw lets an attacker reach privileged Platform Services functionality without valid authentication, most likely through an exposed HTTPS management or data endpoint. No CWE was assigned by NVD, so the precise root-cause class (e.g., missing authentication on a critical function, CWE-306, or improper authentication, CWE-287) is inferred from the vendor tag rather than confirmed.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPUs ship the corrective patches but the source data does not specify an exact fixed build number, so obtain the precise patch level for 11.4.0 from that advisory and apply it as the primary remediation. Until patched, restrict network reachability of the Guided Search Platform Services / Forge HTTPS endpoints to trusted management networks only via firewall or reverse-proxy ACLs, and ensure these services are never directly internet-exposed - the trade-off is that any legitimate remote administration or cross-datacenter indexing traffic must be explicitly allowlisted. Additionally place the service behind an authenticating reverse proxy or WAF to add an authentication layer in front of the vulnerable endpoint, accepting that this may require reconfiguring downstream integration clients.