CVE-2026-61160 in Guided Search
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 8.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Commerce Guided Search and Experience Manager components, specifically affecting version 11.4.0 of the Oracle Commerce platform. The flaw represents a significant security weakness that can be exploited by low-privileged attackers who gain network access through HTTP protocols. The vulnerability's classification as easily exploitable indicates that attackers require minimal skill or resources to leverage this weakness effectively. Security researchers have assessed the risk using CVSS 3.1 scoring methodology, assigning a base score of 8.1 which reflects high severity across both confidentiality and availability impact vectors.
The technical nature of this vulnerability stems from insufficient access controls or authentication mechanisms within the Experience Manager component, allowing unauthorized users to gain access to critical system data and potentially disrupt service availability entirely. Attackers can exploit this weakness to achieve complete data compromise including all accessible information within the Oracle Commerce environment while simultaneously creating conditions that could lead to denial of service scenarios through system hangs or repeated crashes. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) clearly demonstrates the attack surface characteristics where network-based access is required with low attack complexity but only requires low privilege level access, and no user interaction is needed for exploitation.
The operational impact of this vulnerability extends beyond simple data theft to include complete system availability disruption that can severely affect business operations. Organizations relying on Oracle Commerce Guided Search and Experience Manager for their commerce functionality face potential exposure to unauthorized data access that could compromise sensitive customer information, pricing strategies, inventory data, and other critical business assets. The possibility of causing complete system crashes represents a particularly dangerous aspect as it can lead to extended downtime affecting e-commerce operations and revenue generation.
Organizations should implement immediate mitigations including network segmentation to restrict access to Oracle Commerce components, enforcing strict authentication controls, and applying available patches or updates from Oracle as soon as they become available. The vulnerability aligns with CWE-284 (Improper Access Control) and may map to ATT&CK techniques involving privilege escalation and data exposure. Security teams should also consider implementing monitoring solutions to detect anomalous access patterns and network traffic that could indicate exploitation attempts. Regular security assessments and vulnerability scanning should be conducted to identify similar weaknesses in the broader Oracle Commerce ecosystem.
The affected configuration represents a critical concern for organizations operating e-commerce platforms where user data protection and system availability are paramount. Given the high confidentiality and availability impact scores, this vulnerability requires immediate attention from security operations teams and may warrant emergency response procedures if active exploitation is detected within organizational networks. Regular updates to security controls and comprehensive incident response planning should be enhanced to address potential exploitation of similar access control weaknesses in other Oracle Commerce components or related systems.