CVE-2026-61131

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

37th percentile - higher than 37% of all known CVEs

Summary

Vulnerability in Oracle Commerce Platform (component: Dynamo Application Framework) version 11.4.0. An unauthenticated attacker can take over the e-commerce platform via HTTP.

Risk Assessment

Risk of full platform takeover, potentially leading to customer data theft and order manipulation.

Recommendation

Immediately apply the patch from the Oracle Critical Patch Update (CPU).

Original NVD description (English source)

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).