CVE-2026-61160
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. A low-privileged attacker with network access via HTTP can easily exploit this flaw, leading to unauthorized access to critical data or full access to all data, and cause a hang or frequently repeatable crash (full DOS).
Risk Assessment
Risk includes breach of critical data confidentiality and complete service unavailability, potentially causing significant financial and operational losses.
Recommendation
Immediately apply the patch provided by Oracle for version 11.4.0. Restrict network access to the Experience Manager component to trusted users only.
Other vulnerabilities in Oracle Commerce Experience Manager
See all- CVE-2026-70997Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker via HTTP can gain unauthorized access to critical data or all product data and cause a hang or frequent crashes (complete DoS).
- CVE-2026-71012High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. A low-privileged attacker can remotely (HTTP) gain unauthorized access to critical data or all product data and cause partial denial of service.
- CVE-2026-71011Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker can exploit it via HTTP, but requires user interaction. The attack may impact other products (scope change) and result in unauthorized update, insert, delete, and read access to some data.
- CVE-2026-71010High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker with local access to the infrastructure, requiring user interaction, can take over the product.
- CVE-2026-71009High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. Difficult to exploit, but an unauthenticated attacker via HTTP can modify, delete, or create data and gain unauthorized access to critical data.
- CVE-2026-71008Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. A high-privileged attacker can exploit it via HTTP, potentially impacting other products (scope change). Successful attack leads to unauthorized access to critical data or complete access to all data.
- CVE-2026-71007Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. A high-privileged attacker can exploit it via HTTP, potentially impacting other products (scope change). Successful attack leads to unauthorized access to critical data or complete access to all data.
- CVE-2026-71006Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker can exploit it via HTTP, but requires user interaction. The attack may impact other products (scope change) and result in unauthorized update, insert, delete, and read access to some data.
- CVE-2026-71005Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker can exploit it via HTTP, but requires user interaction. The attack may impact other products (scope change) and result in unauthorized update, insert, delete, and read access to some data.
- CVE-2026-71004Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker can exploit it via HTTP, but requires user interaction. The attack may impact other products (scope change) and result in unauthorized update, insert, delete, and read access to some data.
Original NVD description (English source)
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 8.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H).