CVE-2026-61156
A critical flaw in Oracle Commerce Guided Search Platform Services (version 11.4.0) lets anyone on the network create, delete, or change data without authentication. The vulnerability can be triggered over HTTPS and gives attackers full control over the service’s data.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle Commerce Guided Search Platform Services, version 11.4.0, used by organizations that run Oracle Commerce applications.
Real-world impact
An attacker who can reach the service over HTTPS could add, delete, or alter data stored by Oracle Commerce Guided Search Platform Services, or gain complete access to all data the service manages.
Why this severity
The CVSS score of 9.1 reflects that the flaw is easy to exploit (low attack complexity), requires no user interaction, and has no authentication requirement. It also has a high impact on confidentiality and integrity, meaning attackers can read and change data, but it does not affect availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources