CVE-2026-61155 Details
Description
Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search Platform Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search Platform Services accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search Platform Services. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
A vulnerability in the Oracle Commerce Guided Search Platform Services product, specifically in version 11.4.0, has been identified. This easily exploitable issue allows an unauthenticated attacker with network access via HTTP to compromise the service. Successful exploitation can lead to unauthorized access to critical data or complete access to all accessible data within Oracle Commerce Guided Search Platform Services. Additionally, this vulnerability allows for unauthorized actions that can cause the service to hang or crash frequently, leading to a complete denial-of-service condition.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.oracle.com/security-alerts/cpujul2026.html | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | CISA-ADP |
| CWE-306 | Missing Authentication for Critical Function | CISA-ADP |
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| oracle commerce guided search platform services | 11.4.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |