Description
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Oracle Commerce Platform’s Dynamo Application Framework contains a flaw (CWE-306) that can be triggered by unauthenticated HTTP requests. When exploited successfully, the vulnerability permits an attacker to gain complete control of the platform, compromising confidentiality, integrity, and availability of the application and potentially the underlying system.

Affected Systems

Oracle Corporation’s Oracle Commerce Platform, version 11.4.0, is the only version identified as affected. The platform is exposed to the network via HTTP and processes requests from untrusted hosts.

Risk and Exploitability

The CVSS base score of 9.8 classifies the issue as critical, and the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that an unauthenticated network attacker can exercise the flaw with minimal effort. The EPSS score is below 1 %, and the vulnerability is not listed in the CISA KEV catalog, indicating that, while exploitation is possible, the broader threat landscape shows limited current usage. Nevertheless, the high severity and lack of protective controls mandate immediate attention.

Generated by OpenCVE AI on August 22, 2026 at 07:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and apply the Oracle Commerce Platform update that addresses this issue, ensuring the affected 11.4.0 installation is patched to a corrected version.
  • Restrict HTTP traffic to the Commerce Platform by configuring firewall rules or segmentation so that only trusted networks can reach the vulnerable endpoints.
  • If a patch is unavailable or cannot be applied promptly, isolate the affected instance from untrusted networks until remediation is possible.

Generated by OpenCVE AI on August 22, 2026 at 07:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 22 Aug 2026 08:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via HTTP in Oracle Commerce Platform 11.4.0

Sat, 22 Aug 2026 06:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via HTTP in Oracle Commerce Platform
Weaknesses CWE-284
CWE-94

Sat, 22 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 04:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via HTTP in Oracle Commerce Platform
Weaknesses CWE-284
CWE-94

Thu, 20 Aug 2026 09:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated RCE via HTTP in Oracle Commerce Platform 11.4.0
Weaknesses CWE-94

Wed, 19 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated RCE via HTTP in Oracle Commerce Platform 11.4.0
Weaknesses CWE-94

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle commerce Platform
CPEs cpe:2.3:a:oracle:commerce_platform:11.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle commerce Platform
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Commerce Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-22T03:24:48.497Z

Reserved: 2026-08-04T22:06:34.608Z

Link: CVE-2026-70954

cve-icon Vulnrichment

Updated: 2026-08-22T03:24:41.878Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:53.720

Modified: 2026-09-01T13:10:07.890

Link: CVE-2026-70954

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T08:00:13Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function