CVE-2026-61146 in Commerce Guided Search
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Commerce Guided Search and Oracle Commerce Experience Manager products, specifically in the Content Acquisition System component of Oracle Commerce version 11.4.0. The flaw represents a critical security weakness that enables attackers with minimal privileges to execute successful exploitation through network-based HTTP connections, making it particularly dangerous in production environments where these systems handle sensitive commerce data and user interactions.
The technical nature of this vulnerability stems from inadequate access controls within the Content Acquisition System component, which allows authenticated users with low privilege levels to perform actions that should be restricted to administrators or higher-privileged roles. This represents a classic privilege escalation issue that aligns with CWE-276, where improper access control mechanisms fail to properly restrict user capabilities. The vulnerability's CVSS 3.1 score of 9.9 indicates the highest severity level, reflecting the combination of high confidentiality, integrity, and availability impacts that can occur when exploited.
The operational impact of this vulnerability extends beyond the immediate Oracle Commerce Guided Search and Experience Manager systems, as demonstrated by the scope change aspect mentioned in the advisory. Successful exploitation can result in complete system compromise, allowing attackers to gain full control over these commerce platforms. This represents a significant risk to organizations relying on these systems for their core business operations, potentially leading to data breaches, service disruptions, and financial losses. The vulnerability's easily exploitable nature means that threat actors can quickly leverage this weakness without requiring advanced technical skills or extensive reconnaissance.
Organizations should implement immediate mitigations including applying the relevant Oracle security patches, reviewing and strengthening access controls, implementing network segmentation to limit exposure, and monitoring for suspicious activities in the affected systems. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) clearly indicates that this vulnerability can be exploited remotely with low attack complexity, requires only low privilege authentication, and causes catastrophic impacts across all security dimensions. Security teams should also consider implementing additional monitoring measures and access controls as recommended by the ATT&CK framework for preventing unauthorized access to commerce platform components. Organizations must prioritize remediation efforts given the high severity score and potential for widespread impact across their digital commerce infrastructure.