Description
Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search Platform Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search Platform Services and unauthorized read access to a subset of Oracle Commerce Guided Search Platform Services accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H).
Published: 2026-07-21
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw resides in Oracle Commerce Guided Search Platform Services version 11.4.0 and permits an attacker with low privileged network access via HTTP to exploit it. The exploitation can make the service hang or crash, creating a complete loss of availability for the business component, and also allows reading a restricted subset of data, breaching confidentiality. The weakness corresponds to information‑exposure (CWE‑200) and a denial‑of‑service condition (CWE‑400).

Affected Systems

Oracle Corporation’s Oracle Commerce Guided Search Platform Services, version 11.4.0, is the only product variant listed as vulnerable. Other versions or deployments are not currently identified as vulnerable in the available data.

Risk and Exploitability

The CVSS v3.1 base score is 7.1, indicating high severity for availability and moderate confidentiality impact. The EPSS score is reported as less than 1%, suggesting exploitation is currently unlikely, and the vulnerability is not in CISA’s KEV catalog. Based on the description, the likely attack vector is unauthenticated HTTP traffic from a network host, requiring no special privileges and relying on crafted requests to trigger the crash or data leakage.

Generated by OpenCVE AI on August 4, 2026 at 01:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle Commerce Guided Search Platform Services to the latest patched release that addresses the vulnerability
  • If an immediate update is not feasible, restrict or block unauthenticated HTTP traffic to the service, for example by placing it behind a firewall or restricting access to trusted IP ranges
  • Enable monitoring of application logs and system metrics to detect repeated crash events or anomalous data retrieval attempts, and configure alerts for suspicious activity

Generated by OpenCVE AI on August 4, 2026 at 01:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 02:00:00 +0000

Type Values Removed Values Added
Title Denial of Service and Data Exposure via HTTP in Oracle Commerce Guided Search Platform Services

Sun, 02 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
Title Oracle Commerce Guided Search Platform Services Vulnerability Enables Denial of Service and Unauthorized Data Access

Sat, 01 Aug 2026 04:45:00 +0000

Type Values Removed Values Added
Title Oracle Commerce Guided Search Platform Services Vulnerability Enables Denial of Service and Unauthorized Data Access

Tue, 28 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Title Oracle Commerce Guided Search Platform Services Denial of Service and Data Exposure Vulnerability

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Oracle Commerce Guided Search Platform Services Denial of Service and Data Exposure Vulnerability
Weaknesses CWE-200
CWE-400
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search Platform Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search Platform Services and unauthorized read access to a subset of Oracle Commerce Guided Search Platform Services accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H).
First Time appeared Oracle
Oracle commerce Guided Search Platform Services
CPEs cpe:2.3:a:oracle:commerce_guided_search_platform_services:11.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle commerce Guided Search Platform Services
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H'}

Subscriptions

Oracle Commerce Guided Search Platform Services
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T18:24:42.282Z

Reserved: 2026-07-08T15:52:20.738Z

Link: CVE-2026-61165

cve-icon Vulnrichment

Updated: 2026-07-23T18:24:38.039Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T01:45:03Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-400

    Uncontrolled Resource Consumption