CVE-2026-61161: Critical severity Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager vulnerability

Published Jul 21, 2026

Updated

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected Software

3 affected components

Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager=11.4.0

Oracle Commerce Experience Manager=11.4.0

Oracle Commerce Guided Search=11.4.0

Event History

Jul 21, 2026

CVE Published

via MITRE·09:38 PM

Data Sourced

via MITRE·09:38 PM

DescriptionSeverity

Data Sourced

via NVD·10:18 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-61161?

The severity of CVE-2026-61161 is critical with a CVSS score of 9.8.

What type of access is required to exploit CVE-2026-61161?

CVE-2026-61161 can be exploited by an unauthenticated attacker with network access.

Which versions of Oracle Commerce are affected by CVE-2026-61161?

The affected version of Oracle Commerce is 11.4.0.

What components are involved in CVE-2026-61161?

CVE-2026-61161 affects the Endeca Application Controller component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager.

How can I mitigate the risk of CVE-2026-61161?

To mitigate the risk of CVE-2026-61161, it is recommended to update to the patched version provided by Oracle.