CVE-2026-101560
HighCVSS 7.1Summary
Vulnerability in Oracle Commerce Platform (component Dynamo Commerce Server) version 11.4.0. Easily exploitable by a low-privileged attacker with network access via HTTP, leading to unauthorized creation, deletion, or modification of data and partial read access.
Risk Assessment
An attacker could modify or delete critical data and gain access to some data, compromising integrity and confidentiality. CVSS score of 7.1 indicates high risk.
Recommendation
Update Oracle Commerce Platform to a version outside 11.4.0. Implement access controls and monitoring to detect unauthorized changes.
Other vulnerabilities in Oracle Commerce Platform
See all- CVE-2026-70954Critical
Vulnerability in Oracle Commerce Platform (component: Dynamo Application Framework) allows an unauthenticated attacker with network access via HTTP to compromise the system. The attack is easily exploitable and requires no user interaction.
- CVE-2026-70953Critical
Vulnerability in Oracle Commerce Platform (component: Dynamo Application Framework) allows an unauthenticated attacker with network access via TCP to compromise the system. The attack is easily exploitable and requires no user interaction.
- CVE-2026-61131Critical
Vulnerability in Oracle Commerce Platform (component: Dynamo Application Framework) version 11.4.0. An unauthenticated attacker can take over the e-commerce platform via HTTP.
- CVE-2026-61130Critical
Vulnerability in Oracle Commerce Platform (component: Dynamo Application Framework). Affects version 11.4.0. Easily exploitable by an unauthenticated attacker with network access via HTTP. Successful attack can lead to unauthorized access to critical data and cause system hang or frequent crashes (DoS).
- CVE-2026-61129Critical
Vulnerability in Oracle Commerce Platform (component: ATG Portals) version 11.4.0. An unauthenticated attacker can take over the e-commerce platform via HTTP.
- CVE-2026-70955High
Vulnerability in Oracle Commerce Platform (component: Dynamo Application Framework) version 11.4.0. An unauthenticated attacker with access to the physical communication segment can fully compromise the platform.
- CVE-2026-61137High
Vulnerability in Oracle Commerce Platform (Dynamo Application Framework component) version 11.4.0. An unauthenticated attacker via HTTP can compromise the system, though exploitation is difficult.
- CVE-2026-61136High
Vulnerability in Oracle Commerce Platform (version 11.4.0) allows an unauthenticated attacker via HTTP to perform unauthorized modification, read access, and partial denial of service. CVSS 7.3.
- CVE-2026-61135High
Vulnerability in Oracle Commerce Platform (component: Dynamo Application Framework) version 11.4.0. Difficult to exploit, allows an unauthenticated attacker via HTTP to gain unauthorized access and modify critical data.
- CVE-2026-61134Medium
Vulnerability in Oracle Commerce Platform (component: Dynamo Application Framework) version 11.4.0. Difficult to exploit flaw allows a low-privileged attacker with network access via HTTP to unauthorizedly create, delete, or modify critical data and access all platform data.
Original NVD description (English source)
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Commerce Server). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Platform accessible data as well as unauthorized read access to a subset of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS