CVE-2026-34316

MediumCVSS 6.1

Published: 21/07/2026(UTC)Updated: 07/08/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

Vulnerability in Oracle Commerce Service Center (component: Commerce Service Center) version 11.4.0. Easily exploitable, requires user interaction, allows an unauthenticated attacker via HTTP to unauthorized read and modify data.

Risk Assessment

Risk of unauthorized access to Oracle Commerce Service Center data and potential impact on other products (scope change), potentially leading to leakage or manipulation of commerce data.

Recommendation

Apply the patch provided by Oracle for version 11.4.0. Educate users about the risk of clicking suspicious links.

Other vulnerabilities in Oracle Commerce Service Center

CVE-2016-5491High
Unspecified vulnerability in the Oracle Commerce Service Center component in Oracle Commerce 10.0.3.5 and 10.2.0.5 allows remote attackers to affect confidentiality and integrity via unknown vectors.

Original NVD description (English source)

Vulnerability in the Oracle Commerce Service Center product of Oracle Commerce (component: Commerce Service Center). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Service Center. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Service Center, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Service Center accessible data as well as unauthorized read access to a subset of Oracle Commerce Service Center accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).