Description
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Commerce Guided Search / Oracle Commerce Experience Manager suffers an access control flaw (CWE-284) that enables a low‑privileged attacker who can reach the system over HTTP to create, delete, or modify critical data. Successful exploitation provides full read access to all data available through the product, resulting in loss of confidentiality and integrity.

Affected Systems

The affected product is Oracle Commerce Guided Search / Oracle Commerce Experience Manager, specifically version 11.4.0. No other versions are currently known to be vulnerable.

Risk and Exploitability

With a CVSS base score of 8.1 the vulnerability is rated high severity. The EPSS score of less than 1% indicates that current real‑world exploitation is low, and the issue is not listed in the CISA KEV catalog. Despite this, the flaw can be triggered by anyone with network access to the HTTP interface and only requires a low‑privileged account, making the risk significant for publicly exposed deployments.

Generated by OpenCVE AI on August 4, 2026 at 01:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch or upgrade to a fixed version of Oracle Commerce Guided Search / Oracle Commerce Experience Manager.
  • Restrict access to the HTTP interface through firewall rules or a VPN so that only trusted hosts can reach the system.
  • If a patch is not yet available, isolate the affected instance from public networks and monitor for unauthorized data modifications.

Generated by OpenCVE AI on August 4, 2026 at 01:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 02:00:00 +0000

Type Values Removed Values Added
Title Access Control Exploit in Oracle Commerce Guided Search Allows Unauthorized Data Manipulation

Sun, 02 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Manipulation via Exposed HTTP Access in Oracle Commerce Guided Search

Sat, 01 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Manipulation via Exposed HTTP Access in Oracle Commerce Guided Search

Tue, 28 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Title Low‑privileged Attack Enables Unauthorized Data Modification in Oracle Commerce Guided Search

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Title Low‑privileged Attack Enables Unauthorized Data Modification in Oracle Commerce Guided Search

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
CPEs cpe:2.3:a:oracle:commerce_guided_search_\/_oracle_commerce_experience_manager:11.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Commerce Guided Search \/ Oracle Commerce Experience Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T18:37:55.605Z

Reserved: 2026-07-08T15:52:20.737Z

Link: CVE-2026-61150

cve-icon Vulnrichment

Updated: 2026-07-23T18:37:51.715Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T01:45:03Z

Weaknesses