Summary
CVE-2026-61157 is a high-severity unauthenticated information disclosure vulnerability affecting Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The flaw, classified under CWE-284 (Improper Access Control), allows a remote, unauthenticated attacker to send crafted HTTP requests to the Experience Manager component and gain unauthorized access to critical data — including potentially full access to all data accessible by the platform. It was patched by Oracle in the July 2026 Critical Patch Update (CPU), released on July 21, 2026.
Technical details
- Root cause: Improper access control (CWE-284) in the Experience Manager component of Oracle Commerce Guided Search, which fails to enforce authorization checks on inbound HTTP requests.
- Trigger conditions: The vulnerability is exploitable over the network via standard HTTP, with no authentication, no privileges, and no user interaction required.
- Attack vector: Remote, unauthenticated network access over HTTP (AV:N, AC:L, PR:N, UI:N); attack complexity is low, making exploitation straightforward and automatable.
- Impact: High confidentiality impact — a successful attacker can gain unauthorized access to critical or complete data accessible to the Oracle Commerce Guided Search / Experience Manager instance. There is no integrity or availability impact.
Affected software
- Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0
Severity
- CVSS v3.1 Base Score: 7.5 (HIGH)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Mitigation and recommended actions
- Immediate: Apply the Oracle July 2026 Critical Patch Update (CPU), which contains security patches addressing this vulnerability. Refer to Oracle Support document CPU274 for patch availability, applicability, and installation instructions specific to Oracle Commerce products.
- Network mitigation: If immediate patching is not possible, restrict external network access to Oracle Commerce Experience Manager endpoints and enforce perimeter controls (e.g., firewall rules, reverse-proxy authentication layers) to limit exposure of the platform to trusted IP ranges only.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

