CVE-2026-61129: Oracle Commerce Platform Auth Bypass Flaw

CVE-2026-61129 Overview

CVE-2026-61129 is a critical vulnerability in the Oracle Commerce Platform product of Oracle Commerce, specifically within the ATG Portals component. The affected supported version is 11.4.0. An unauthenticated remote attacker with network access via HTTP can exploit this flaw to fully compromise Oracle Commerce Platform. Successful exploitation results in complete takeover of the affected product, impacting confidentiality, integrity, and availability. The vulnerability was disclosed as part of the Oracle Critical Patch Update advisory for July 2026.

Critical Impact
Unauthenticated attackers can achieve full takeover of Oracle Commerce Platform 11.4.0 over the network with low attack complexity and no user interaction.

Affected Products

Oracle Commerce Platform 11.4.0
Oracle Commerce (ATG Portals component)
Deployments exposing the ATG Portals HTTP interface to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-61129 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-61129

Vulnerability Analysis

The vulnerability resides in the ATG Portals component of Oracle Commerce Platform 11.4.0. Oracle classifies the flaw as easily exploitable, with the attacker requiring only network reachability to the HTTP interface. No authentication is required, and no user interaction is involved in the attack chain.

A successful attack results in full takeover of the Oracle Commerce Platform. The confidentiality, integrity, and availability impacts are all rated high, indicating the attacker can read sensitive data, modify application state, and disrupt service. Because Oracle Commerce is typically deployed as a customer-facing e-commerce platform, exploitation exposes order data, customer records, and payment workflows.

The current EPSS probability is 0.486%, reflecting a moderate near-term exploitation forecast despite the high severity rating.

Root Cause

Oracle has not publicly disclosed the underlying weakness class or CWE mapping for CVE-2026-61129. The vendor advisory states only that the ATG Portals component contains a flaw permitting unauthenticated compromise over HTTP. Historically, similar ATG Portals issues have involved improper input handling and authentication bypass in portal request processing.

Attack Vector

The attack is executed remotely over the network using standard HTTP requests to the ATG Portals endpoint. The attacker does not need valid credentials or any prior foothold. Because ATG Portals is often exposed as part of the storefront presentation tier, internet-facing deployments are directly reachable by opportunistic scanners.

No public proof-of-concept exploit or exploitation-in-the-wild activity has been reported at the time of publication. Refer to the Oracle Security Alert July 2026 for authoritative technical details.

Detection Methods for CVE-2026-61129

Indicators of Compromise

Unexpected HTTP requests to ATG Portals paths from external IP addresses, particularly with anomalous parameters or payload sizes
New administrative sessions, user accounts, or role assignments created within Oracle Commerce without a corresponding change ticket
Outbound network connections from the Commerce application server to unknown hosts following inbound HTTP traffic to portal endpoints

Detection Strategies

Inspect web server and application logs for anomalous URI patterns targeting ATG Portals handlers and correlate with source reputation data
Deploy web application firewall (WAF) signatures for known Oracle Commerce exploitation attempts once vendor guidance is published
Baseline normal ATG Portals request volume and alert on statistically significant deviations in request rate, method mix, or response codes

Monitoring Recommendations

Forward Oracle Commerce application, access, and audit logs to a centralized SIEM for retention and correlation
Monitor for creation of new files, JSP pages, or class definitions within Commerce application directories
Track process execution on Commerce hosts and alert on shells or scripting interpreters spawned by the application server user

How to Mitigate CVE-2026-61129

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all Oracle Commerce Platform 11.4.0 deployments
Restrict inbound HTTP access to ATG Portals endpoints to trusted networks or through an authenticated reverse proxy where feasible
Review recent authentication, administrative, and file-system activity on Commerce hosts for signs of prior compromise

Patch Information

Oracle addressed CVE-2026-61129 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for the exact patch identifiers, prerequisites, and installation procedures applicable to Oracle Commerce Platform 11.4.0.

Workarounds

Place the ATG Portals interface behind a WAF configured to block anomalous requests and enforce strict input validation
Segment the Commerce application tier from the wider network and restrict egress to only required destinations
Disable or firewall off unused ATG Portals functionality until the vendor patch can be deployed

bash

# Example: restrict inbound access to ATG Portals HTTP endpoint at the firewall
# Replace 203.0.113.0/24 with your trusted management network
iptables -A INPUT -p tcp --dport 8080 -s 203.0.113.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP