CVE-2026-61150 in Commerce Guided Search
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability exists within Oracle Commerce Guided Search and Oracle Commerce Experience Manager components, specifically affecting version 11.4.0 of the Oracle Commerce platform. The flaw represents a significant security weakness that can be exploited by attackers with minimal privileges and network access through standard HTTP protocols. The vulnerability's classification as easily exploitable indicates that the attack vector requires little sophistication or specialized tools, making it particularly dangerous in production environments where such systems are often exposed to external networks.
The technical nature of this vulnerability stems from insufficient authorization controls within the Experience Manager component, which allows authenticated users with low privilege levels to perform administrative actions. This represents a classic privilege escalation issue where legitimate user credentials can be leveraged to gain unauthorized access to critical system functions. The CVSS 3.1 score of 8.1 reflects the high severity impact, with both confidentiality and integrity compromised at the highest level. Attackers can exploit this weakness to create, delete, or modify sensitive data within the platform, potentially leading to complete data destruction or unauthorized data manipulation.
The operational impact of this vulnerability extends beyond simple data compromise, as it enables attackers to gain complete access to all accessible data within the Oracle Commerce environment. This includes customer information, transaction records, product catalogs, and other business-critical data that organizations rely upon for their operations. The vulnerability's ability to affect both data modification and unauthorized access creates multiple attack surfaces for potential exploitation, allowing malicious actors to not only view sensitive information but also alter it in ways that could severely impact business operations and customer trust.
Organizations should implement immediate mitigations including network segmentation to limit direct access to the affected components, enhanced authentication controls with multi-factor authentication, and comprehensive monitoring of administrative activities. Regular security assessments should be conducted to identify similar authorization flaws within the Oracle Commerce platform and related systems. The vulnerability aligns with CWE-285 (Improper Authorization) and maps to ATT&CK techniques involving privilege escalation and data manipulation. System administrators must also review and restrict user permissions to ensure least privilege access, while implementing proper network controls to limit exposure to unauthorized network access via HTTP protocols. This vulnerability demonstrates the critical importance of maintaining up-to-date security patches and conducting thorough security reviews of all Oracle Commerce components to prevent similar issues from compromising enterprise data integrity and confidentiality.