CVE-2026-61147

Analyzed Analyzed - Analysis Complete

Denial of Service in Oracle Commerce Guided Search

Publication date: 2026-07-21

Last updated on: 2026-07-24

Assigner: Oracle

Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-24

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-61147

EUVD

EUVD-2026-47355

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	commerce_experience_manager	11.4.0
oracle	commerce_guided_search	11.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It allows an unauthenticated attacker with access to the system's infrastructure to cause a denial of service (DOS) by crashing or hanging the application repeatedly.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. General detection would involve checking for Oracle Commerce Guided Search or Oracle Commerce Experience Manager version 11.4.0 and monitoring for crashes or hangs in the Content Acquisition System component.

Impact Analysis

If exploited, this vulnerability could disrupt the availability of Oracle Commerce Guided Search / Oracle Experience Manager services, leading to downtime and preventing users from accessing critical commerce functions.

Compliance Impact

This vulnerability causes denial-of-service (DOS) conditions, disrupting system availability. For GDPR, availability impacts may affect data processing operations requiring uninterrupted access. HIPAA requires safeguards for data availability; prolonged outages could lead to compliance gaps. However, the CVE does not specify direct compliance violations.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. Disable unnecessary services and restrict network access to the vulnerable component. Monitor system logs for signs of exploitation attempts.

Hi! I’m here to help you understand CVE-2026-61147. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70