CVE-2026-61129

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

37th percentile - higher than 37% of all known CVEs

Summary

Vulnerability in Oracle Commerce Platform (component: ATG Portals) version 11.4.0. An unauthenticated attacker can take over the e-commerce platform via HTTP.

Risk Assessment

Risk of full platform takeover, potentially leading to customer data theft and order manipulation.

Recommendation

Immediately install the patch from the Oracle Critical Patch Update (CPU).

Original NVD description (English source)

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: ATG Portals). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).