Oracle Commerce vulnerabilities
4 known CVE vulnerabilities in Oracle Commerce, translated and rated.
- CVE-2026-61162High
A vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) in version 11.4.0. A low privileged attacker with local access can easily exploit this vulnerability to gain unauthorized creation, deletion, or modification of critical data and access to all data (CVSS 7.1).
- CVE-2026-61158High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce, component Experience Manager. Affects version 11.4.0. An unauthenticated attacker can remotely access critical data or all data in the system via RMI.
- CVE-2026-61157High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce, component Experience Manager. Affects version 11.4.0. An unauthenticated attacker can remotely access critical data or all data in the system via HTTP.
- CVE-2026-61148High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A low-privileged attacker with network access via HTTP can take over the system.