CVE-2026-61158 in Guided Search
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Commerce Guided Search and Oracle Commerce Experience Manager components, specifically affecting version 11.4.0 of the Oracle Commerce platform. The flaw resides in the Remote Method Invocation (RMI) interface which is improperly configured to accept connections without authentication requirements. This represents a critical security oversight that allows any network-based attacker to establish connections to the vulnerable system without providing valid credentials or access tokens.
The technical nature of this vulnerability stems from insufficient authentication controls within the RMI communication channel, creating an attack surface where malicious actors can directly interact with the Experience Manager component. The CVSS 3.1 score of 7.5 indicates a high severity issue with confidentiality impacts, where the base vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N demonstrates that network-based exploitation is easily achievable with low attack complexity and no privilege requirements. The vulnerability's classification aligns with CWE-284 (Improper Access Control) and CWE-310 (Cryptographic Issues), as it involves unauthorized access to system resources through insecure remote communication protocols.
The operational impact of this vulnerability is severe, as successful exploitation can lead to complete unauthorized access to all data within the Oracle Commerce Guided Search and Experience Manager systems. Attackers could potentially extract sensitive customer information, transactional data, product catalogs, and other critical business data that resides within these components. The lack of authentication requirements means that even basic reconnaissance activities could reveal system configurations, user data, or internal business processes that would otherwise remain protected.
Organizations should immediately implement network-level mitigations including firewall rules to block RMI traffic on the affected ports, particularly port 1099 which is commonly used for RMI services. System administrators should also consider disabling RMI interfaces entirely if they are not required for legitimate business operations, or at minimum ensure that all RMI communications are properly secured through SSL/TLS encryption and require strong authentication mechanisms. The vulnerability's characteristics align with ATT&CK technique T1190 (Exploit Public-Facing Application) and T1071.004 (Application Layer Protocol: DNS), as attackers could leverage this weakness to establish persistent access to critical commerce infrastructure.
Security teams should conduct immediate vulnerability assessments to identify all systems running Oracle Commerce 11.4.0 and verify whether the vulnerable RMI interfaces are accessible from external networks. Additionally, organizations should implement monitoring solutions to detect unauthorized RMI connection attempts and consider applying Oracle's security patches as soon as they become available through official support channels. The combination of low attack complexity and high impact data confidentiality makes this vulnerability particularly dangerous for retail and e-commerce environments where customer data protection is paramount.