CVE-2026-61130

CriticalCVSS 9.1

Published: 21/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

Vulnerability in Oracle Commerce Platform (component: Dynamo Application Framework). Affects version 11.4.0. Easily exploitable by an unauthenticated attacker with network access via HTTP. Successful attack can lead to unauthorized access to critical data and cause system hang or frequent crashes (DoS).

Risk Assessment

An unauthenticated attacker can access all data in Oracle Commerce Platform and cause a complete denial of service, resulting in loss of confidentiality and availability.

Recommendation

Apply the security patch provided by Oracle for version 11.4.0.

Original NVD description (English source)

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Platform accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Platform. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).