Description
Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search Platform Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search Platform Services accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search Platform Services. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
Published: 2026-07-21
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in Oracle Commerce Guided Search Platform Services allows an unauthenticated attacker with network access via HTTP to obtain unauthorized access to critical data and to cause a denial‑of‑service condition. The flaw provides high confidentiality impact and complete availability loss, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. The weakness can be classified as improper access control and information exposure.

Affected Systems

Oracle Commerce Guided Search Platform Services version 11.4.0

Risk and Exploitability

The CVSS base score of 9.1 indicates critical severity, while the EPSS score of less than 1% suggests that exploitation is unlikely in the current landscape but the flaw remains highly dangerous if discovered. The vulnerability is not currently listed in CISA’s Known Exploited Vulnerabilities catalog, but the attack vector is an unauthenticated HTTP request, making it simple for a remote actor to attempt exploitation.

Generated by OpenCVE AI on August 4, 2026 at 01:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch or upgrade to a version where the access control flaw is resolved. \"Oracle Commerce Guided Search Platform Services\" releases from July 2026 contain the required fix.
  • Configure network controls to limit HTTP traffic to trusted hosts or to secure a VPN connection before reaching the service. This reduces the exposed attack surface until a patch can be applied.
  • If a patch cannot be applied immediately, isolate the service from the public network, disable unused endpoints, and monitor for suspicious HTTP activity. These temporary measures restrict access but are not a substitute for the official fix.

Generated by OpenCVE AI on August 4, 2026 at 01:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 02:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Control and Denial of Service in Oracle Commerce Guided Search Platform Services

Thu, 30 Jul 2026 11:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Control and Denial of Service in Oracle Commerce Guided Search Platform Services

Tue, 28 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP-based Access Vulnerability in Oracle Commerce Guided Search Platform Services
Weaknesses CWE-200

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP-based Access Vulnerability in Oracle Commerce Guided Search Platform Services
Weaknesses CWE-200

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-306
CWE-400
CWE-732
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search Platform Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search Platform Services accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search Platform Services. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
First Time appeared Oracle
Oracle commerce Guided Search Platform Services
CPEs cpe:2.3:a:oracle:commerce_guided_search_platform_services:11.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle commerce Guided Search Platform Services
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}

Subscriptions

Oracle Commerce Guided Search Platform Services
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T18:34:42.164Z

Reserved: 2026-07-08T15:52:20.737Z

Link: CVE-2026-61155

cve-icon Vulnrichment

Updated: 2026-07-23T18:34:37.456Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T01:45:03Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-306

    Missing Authentication for Critical Function

  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-732

    Incorrect Permission Assignment for Critical Resource