Commerce Platform
Monthly
Full platform takeover is possible in Oracle Commerce Platform 11.4.0 via the Dynamo Application Framework component, exploitable by an unauthenticated attacker who can reach the adjacent network segment hosting the server. The CVSS vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that successful exploitation yields complete compromise of confidentiality, integrity, and availability - consistent with Oracle's characterization of 'takeover.' No public exploit code has been identified at time of analysis, and this CVE does not appear on the CISA KEV catalog.
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with only HTTP network access to fully compromise the platform, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable' requiring no authentication or user interaction. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Remote takeover in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with only TCP network access to fully compromise the platform. Rated CVSS 9.8 with complete confidentiality, integrity and availability loss, the flaw requires no authentication or user interaction, making it a top-tier remediation priority. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and total-compromise impact warrant immediate patching via Oracle's August 2026 Critical Patch Update.
Full takeover of Oracle Commerce Platform 11.4.0 is possible by a remote unauthenticated attacker who reaches the Dynamo Application Framework component over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation compromises confidentiality, integrity, and availability of the platform (CVSS 3.1 8.1), though Oracle rates it difficult to exploit (AC:H). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data tampering and partial denial of service in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework) allows a remote attacker to reach the platform over HTTP and, without any credentials, perform unauthorized insert/update/delete on some accessible data, read a subset of accessible data, and partially disrupt availability. Oracle rates it easily exploitable with a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
Data compromise in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a remote, unauthenticated attacker read, create, modify, or delete all data accessible to the platform over HTTP. The flaw carries a CVSS 3.1 score of 7.4 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as difficult to exploit (AC:H). Disclosed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in Oracle Commerce Platform 11.4.0 exposes full data confidentiality and integrity through the Dynamo Application Framework component, allowing a low-privileged network attacker to read or modify all platform data via HTTP. The CVSS 3.1 score of 6.8 reflects meaningful exploitation complexity (AC:H) and the requirement for at least some authenticated access (PR:L), limiting opportunistic mass exploitation. No public exploit code or active exploitation has been identified at time of analysis, and remediation is available via Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Commerce Platform 11.4.0 lets a remote, unauthenticated attacker reaching the Dynamo Application Framework's LDAP integration read critical application data, potentially all data accessible to the platform. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score in the provided data, so this is a serious-but-not-yet-weaponized disclosure flaw disclosed in the July 2026 Oracle Critical Patch Update.
Cross-context data compromise in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework/ATG) lets a low-privileged, authenticated network attacker who lures a victim into interacting with crafted HTTP content read all platform-accessible data and make limited unauthorized modifications, with impact crossing into additional products via a scope change. The CVSS:3.1 score is 7.6 (C:H/I:L, scope-changed), and the UI:R plus scope-change profile is characteristic of a stored/reflected web-injection class flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with HTTP network access to fully compromise the product, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 9.8 (Critical) rating. Oracle describes the flaw as easily exploitable, though it publishes no technical root-cause detail beyond the CPU advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated network reach and complete system takeover makes this a top-tier patch priority.
Remote unauthenticated compromise of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a network attacker reach sensitive data and knock the service offline over HTTP. With no authentication or user interaction required and a CVSS 3.1 base of 9.1, a successful attack yields access to all Commerce Platform-accessible data plus a complete, repeatable denial of service. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full system takeover of Oracle Commerce Platform 11.4.0 is possible when a remote, unauthenticated attacker reaches the ATG Portals component over HTTP. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and yields complete compromise of the platform. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Personalization Server). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Platform). Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Epss exploitation probability 41.1%.
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the Oracle Commerce Platform component of Oracle Commerce (subcomponent: Dynamo Application Framework). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Commerce Platform component of Oracle Commerce (subcomponent: Dynamo Application Framework). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Commerce Platform component of Oracle Commerce (subcomponent: Dynamo Application Framework). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.1.1, 3.1.2, 11.0, and 11.1 allows remote attackers to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.0.2, 3.1.1, 3.1.2, 11.0, and 11.1 allows remote attackers. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Oracle Commerce Platform component in Oracle Commerce Platform 9.4, 10.0, and 10.2 allows remote attackers to affect integrity via vectors related to Dynamo. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Full platform takeover is possible in Oracle Commerce Platform 11.4.0 via the Dynamo Application Framework component, exploitable by an unauthenticated attacker who can reach the adjacent network segment hosting the server. The CVSS vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that successful exploitation yields complete compromise of confidentiality, integrity, and availability - consistent with Oracle's characterization of 'takeover.' No public exploit code has been identified at time of analysis, and this CVE does not appear on the CISA KEV catalog.
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with only HTTP network access to fully compromise the platform, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable' requiring no authentication or user interaction. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Remote takeover in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with only TCP network access to fully compromise the platform. Rated CVSS 9.8 with complete confidentiality, integrity and availability loss, the flaw requires no authentication or user interaction, making it a top-tier remediation priority. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and total-compromise impact warrant immediate patching via Oracle's August 2026 Critical Patch Update.
Full takeover of Oracle Commerce Platform 11.4.0 is possible by a remote unauthenticated attacker who reaches the Dynamo Application Framework component over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation compromises confidentiality, integrity, and availability of the platform (CVSS 3.1 8.1), though Oracle rates it difficult to exploit (AC:H). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data tampering and partial denial of service in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework) allows a remote attacker to reach the platform over HTTP and, without any credentials, perform unauthorized insert/update/delete on some accessible data, read a subset of accessible data, and partially disrupt availability. Oracle rates it easily exploitable with a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
Data compromise in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a remote, unauthenticated attacker read, create, modify, or delete all data accessible to the platform over HTTP. The flaw carries a CVSS 3.1 score of 7.4 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as difficult to exploit (AC:H). Disclosed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in Oracle Commerce Platform 11.4.0 exposes full data confidentiality and integrity through the Dynamo Application Framework component, allowing a low-privileged network attacker to read or modify all platform data via HTTP. The CVSS 3.1 score of 6.8 reflects meaningful exploitation complexity (AC:H) and the requirement for at least some authenticated access (PR:L), limiting opportunistic mass exploitation. No public exploit code or active exploitation has been identified at time of analysis, and remediation is available via Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Commerce Platform 11.4.0 lets a remote, unauthenticated attacker reaching the Dynamo Application Framework's LDAP integration read critical application data, potentially all data accessible to the platform. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score in the provided data, so this is a serious-but-not-yet-weaponized disclosure flaw disclosed in the July 2026 Oracle Critical Patch Update.
Cross-context data compromise in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework/ATG) lets a low-privileged, authenticated network attacker who lures a victim into interacting with crafted HTTP content read all platform-accessible data and make limited unauthorized modifications, with impact crossing into additional products via a scope change. The CVSS:3.1 score is 7.6 (C:H/I:L, scope-changed), and the UI:R plus scope-change profile is characteristic of a stored/reflected web-injection class flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with HTTP network access to fully compromise the product, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 9.8 (Critical) rating. Oracle describes the flaw as easily exploitable, though it publishes no technical root-cause detail beyond the CPU advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated network reach and complete system takeover makes this a top-tier patch priority.
Remote unauthenticated compromise of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a network attacker reach sensitive data and knock the service offline over HTTP. With no authentication or user interaction required and a CVSS 3.1 base of 9.1, a successful attack yields access to all Commerce Platform-accessible data plus a complete, repeatable denial of service. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full system takeover of Oracle Commerce Platform 11.4.0 is possible when a remote, unauthenticated attacker reaches the ATG Portals component over HTTP. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and yields complete compromise of the platform. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Personalization Server). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Platform). Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Epss exploitation probability 41.1%.
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the Oracle Commerce Platform component of Oracle Commerce (subcomponent: Dynamo Application Framework). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Commerce Platform component of Oracle Commerce (subcomponent: Dynamo Application Framework). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Commerce Platform component of Oracle Commerce (subcomponent: Dynamo Application Framework). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.1.1, 3.1.2, 11.0, and 11.1 allows remote attackers to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.0.2, 3.1.1, 3.1.2, 11.0, and 11.1 allows remote attackers. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Oracle Commerce Platform component in Oracle Commerce Platform 9.4, 10.0, and 10.2 allows remote attackers to affect integrity via vectors related to Dynamo. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.