CVE-2026-61148
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A low-privileged attacker with network access via HTTP can take over the system.
Risk Assessment
Risk of complete takeover of the e-commerce platform, potentially leading to customer data theft and store downtime.
Recommendation
Apply the Oracle security patch for Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0.
Other vulnerabilities in Oracle Commerce
See all- CVE-2026-61162High
A vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) in version 11.4.0. A low privileged attacker with local access can easily exploit this vulnerability to gain unauthorized creation, deletion, or modification of critical data and access to all data (CVSS 7.1).
- CVE-2026-61158High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce, component Experience Manager. Affects version 11.4.0. An unauthenticated attacker can remotely access critical data or all data in the system via RMI.
- CVE-2026-61157High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce, component Experience Manager. Affects version 11.4.0. An unauthenticated attacker can remotely access critical data or all data in the system via HTTP.
Original NVD description (English source)
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).