Auth bypass in Oracle Commerce Guided Search Platform Services
CVE-2026-61154
Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search Platform Services. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search Platform Services. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability class: Privilege Escalation
EPSS: 0.005 (41.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Oracle Commerce_guided_search_platform_services — versions 11.4.0
- Oracle Corporation Commerce Guided Search Platform Services — versions 11.4.0
Weakness classification (CWE)
References
- secalert_us@oracle.com (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-61154?
- CVE-2026-61154 is a critical-severity vulnerability in Oracle Commerce Guided Search Platform Services, classified under Improper Privilege Management. CVSS score: 9.8/10. Published 2026-07-21.
- How severe is CVE-2026-61154?
- Critical severity. CVSS v3 base score is 9.8 out of 10.