CVE-2026-61136

Analyzed Analyzed - Analysis Complete

Oracle Commerce Platform Unauthenticated Data Access Vulnerability

Publication date: 2026-07-21

Last updated on: 2026-07-27

Assigner: Oracle

Description

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Platform accessible data as well as unauthorized read access to a subset of Oracle Commerce Platform accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Commerce Platform. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-61136

EUVD

EUVD-2026-47345

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	commerce_platform	11.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Commerce Platform version 11.4.0 within the Dynamo Application Framework component. It allows unauthenticated attackers to remotely access the system via HTTP and perform unauthorized data modifications, data theft, or cause partial service disruption. The vulnerability has a CVSS score of 7.3, indicating significant impact on confidentiality, integrity, and availability.

Detection Guidance

Since this is a vulnerability in Oracle Commerce Platform 11.4.0, detection involves checking for exposed instances of this software and verifying patch levels. Look for HTTP services running on standard ports (80, 443, 8080, etc.) and inspect server headers or responses for Oracle Commerce Platform version information. Use network scanning tools like Nmap to identify services and versions.

Impact Analysis

If exploited, attackers could read, modify, or delete some data in Oracle Commerce Platform without authentication. This may lead to data breaches, loss of sensitive information, or disruption of services, affecting business operations and customer trust.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations may face legal penalties, fines, or reputational damage due to non-compliance resulting from this security flaw.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Commerce Platform version 11.4.0. Restrict network access to HTTP ports and disable unnecessary services. Monitor for unusual activity or unauthorized data access.

Hi! I’m here to help you understand CVE-2026-61136. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70