CVE-2026-61147: Medium severity Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager vulnerability
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker must have logon access to the infrastructure where the affected Oracle Commerce Guided Search or Oracle Commerce Experience Manager instance runs. The CVSS vector indicates local attack access.
Which deployments are known to be affected?
The affected component is the Content Acquisition System in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Version 11.4.0 is identified as affected.
What is the impact of successful exploitation?
Successful exploitation can cause the product to hang or crash repeatedly, resulting in a complete denial of service. The stated impact is limited to availability; no confidentiality or integrity impact is listed.