CVE-2026-61132

Analyzed Analyzed - Analysis Complete

Unauthorized Access in Oracle Commerce Platform via Dynamo Application Framework

Publication date: 2026-07-21

Last updated on: 2026-07-27

Assigner: Oracle

Description

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Platform accessible data as well as unauthorized update, insert or delete access to some of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-61132

EUVD

EUVD-2026-47341

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	commerce_platform	11.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects Oracle Commerce Platform version 11.4.0. It allows a low-privileged attacker with network access via HTTP to potentially compromise the system. Exploitation requires human interaction from someone other than the attacker. Successful attacks can lead to unauthorized access to critical data or complete access to all accessible data in Oracle Commerce Platform, as well as unauthorized modifications to some data.

Detection Guidance

This vulnerability affects Oracle Commerce Platform 11.4.0 via the Dynamo Application Framework. Detection requires checking for vulnerable versions of Oracle Commerce Platform. No specific commands are provided in the available context. Review Oracle's security advisories and apply patches if affected.

Impact Analysis

If exploited, this vulnerability could allow attackers to access sensitive data stored in Oracle Commerce Platform or modify certain data. Since attacks may impact additional products beyond Oracle Commerce Platform, the risk could extend to other systems or data within your environment. The need for human interaction slightly reduces the risk but does not eliminate it.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized data exposure or alteration could result in legal penalties, reputational damage, or loss of trust. Organizations using Oracle Commerce Platform should assess their exposure and implement mitigations to maintain compliance.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Commerce Platform version 11.4.0. Monitor Oracle's security advisories for updates. Restrict network access to the Dynamo Application Framework component via HTTP. Implement strong authentication and authorization controls for users with low privileges.

Hi! I’m here to help you understand CVE-2026-61132. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70