CVE-2026-61158
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce, component Experience Manager. Affects version 11.4.0. An unauthenticated attacker can remotely access critical data or all data in the system via RMI.
Risk Assessment
Risk of leakage of customer data and e-commerce configuration, potentially violating customer trust and data protection regulations.
Recommendation
Apply the patch provided by Oracle in the Critical Patch Update (CPU) for Oracle Commerce immediately.
Other vulnerabilities in Oracle Commerce
See all- CVE-2026-61162High
A vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) in version 11.4.0. A low privileged attacker with local access can easily exploit this vulnerability to gain unauthorized creation, deletion, or modification of critical data and access to all data (CVSS 7.1).
- CVE-2026-61157High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce, component Experience Manager. Affects version 11.4.0. An unauthenticated attacker can remotely access critical data or all data in the system via HTTP.
- CVE-2026-61148High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A low-privileged attacker with network access via HTTP can take over the system.
Original NVD description (English source)
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).