CVE-2026-61162
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) in version 11.4.0. A low privileged attacker with local access can easily exploit this vulnerability to gain unauthorized creation, deletion, or modification of critical data and access to all data (CVSS 7.1).
Risk Assessment
An attacker can gain unauthorized access to critical commerce data and modify it, potentially leading to data integrity and confidentiality breaches.
Recommendation
Apply the patch provided by Oracle for Oracle Commerce Guided Search / Experience Manager version 11.4.0.
Other vulnerabilities in Oracle Commerce
See all- CVE-2026-61158High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce, component Experience Manager. Affects version 11.4.0. An unauthenticated attacker can remotely access critical data or all data in the system via RMI.
- CVE-2026-61157High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce, component Experience Manager. Affects version 11.4.0. An unauthenticated attacker can remotely access critical data or all data in the system via HTTP.
- CVE-2026-61148High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A low-privileged attacker with network access via HTTP can take over the system.
Original NVD description (English source)
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).