CVE-2026-61160: Oracle Commerce Auth Bypass Vulnerability

CVE-2026-61160 Overview

CVE-2026-61160 affects Oracle Commerce Guided Search and Oracle Commerce Experience Manager version 11.4.0. The flaw resides in the Experience Manager component. An authenticated attacker with low privileges can exploit the issue over the network via HTTP without user interaction.

Successful exploitation grants unauthorized access to critical data across the product and enables a complete denial of service through a hang or repeatable crash. Oracle disclosed the vulnerability in the July 2026 Critical Patch Update.

Critical Impact

Low-privileged network attackers can extract all data accessible to Oracle Commerce Guided Search and trigger a complete denial of service against the Experience Manager component.

Affected Products

• Oracle Commerce Guided Search 11.4.0
• Oracle Commerce Experience Manager 11.4.0
• Oracle Commerce (Experience Manager component)

Discovery Timeline

• 2026-07-21 - CVE-2026-61160 published to NVD
• 2026-07-21 - Last updated in NVD database
• July 2026 - Oracle publishes patch in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-61160

Vulnerability Analysis

The vulnerability resides in the Experience Manager component of Oracle Commerce Guided Search. An attacker holding a low-privileged account can send crafted HTTP requests to reach vulnerable functionality. The attack complexity is low and requires no user interaction.

Exploitation yields two distinct outcomes. First, the attacker can read data across the product boundary, including data not associated with their own account. Second, the attacker can force a hang or a repeatable crash, producing a full denial of service against the Experience Manager service.

The scope is unchanged, meaning the impact remains within the vulnerable component. However, given the Experience Manager governs merchandising, personalization, and site content, a denial of service directly affects storefront availability for downstream Commerce deployments.

Root Cause

Oracle has not published a public technical breakdown of the root cause. The advisory confirms the flaw exists in the Experience Manager component of the 11.4.0 release train. Confidentiality and availability impacts are rated High, while integrity is not affected.

Attack Vector

The attack vector is network-based over HTTP. An authenticated user with low privileges is the minimum requirement, which aligns with a broad set of internal or federated Commerce accounts. No social engineering or user interaction is required to trigger the condition.

Oracle has not disclosed exploit code, and no public proof of concept is available at the time of publication. The Oracle Critical Patch Update July 2026 advisory is the authoritative source for technical details and fix availability.

Detection Methods for CVE-2026-61160

Indicators of Compromise

• Repeated HTTP requests from a single low-privileged Commerce user account targeting Experience Manager endpoints.
• Unexpected Experience Manager service hangs, restarts, or crash logs correlated with authenticated HTTP sessions.
• Bulk retrieval patterns against Experience Manager APIs that exceed normal merchandising workflows.

Detection Strategies

• Enable verbose HTTP access logging on Oracle Commerce Guided Search endpoints and forward logs to a centralized SIEM for correlation.
• Baseline typical Experience Manager request volumes per authenticated user and alert on statistical deviations.
• Monitor application error logs for repeated stack traces or JVM out-of-memory events tied to Experience Manager threads.

Monitoring Recommendations

• Track authentication events for Experience Manager accounts and flag low-privilege sessions performing administrative-scope reads.
• Alert on process restarts or health-check failures for the Experience Manager service.
• Retain HTTP request bodies and headers for Experience Manager traffic to support post-incident forensics.

How to Mitigate CVE-2026-61160

Immediate Actions Required

• Apply the July 2026 Oracle Critical Patch Update to Oracle Commerce Guided Search / Experience Manager 11.4.0 without delay.
• Inventory all Oracle Commerce 11.4.0 deployments, including staging and pre-production environments, and prioritize internet-facing instances.
• Rotate credentials for low-privileged Commerce accounts if unusual Experience Manager activity is present in logs.

Patch Information

Oracle addressed CVE-2026-61160 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update July 2026 advisory for the exact patch identifiers, prerequisites, and installation instructions applicable to their deployment.

Workarounds

• Restrict network access to Experience Manager endpoints using firewall rules or reverse proxy allowlists until the patch is applied.
• Tighten role assignments so only required accounts retain access to Experience Manager HTTP interfaces.
• Place a web application firewall in front of Commerce endpoints and rate-limit authenticated requests to Experience Manager paths.

# Example: restrict Experience Manager endpoints at the reverse proxy
# nginx snippet - allow only trusted management subnet
location /experience-manager/ {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://commerce-backend;
}