CVE-2026-61161: Oracle Commerce Auth Bypass Vulnerability

CVE-2026-61161 Overview

CVE-2026-61161 is a critical vulnerability in the Oracle Commerce Guided Search and Oracle Commerce Experience Manager products, specifically within the Endeca Application Controller component. The affected version is 11.4.0. An unauthenticated attacker with network access via HTTP can exploit this flaw to fully compromise the target system. Successful exploitation results in complete takeover of the Oracle Commerce Guided Search and Experience Manager deployment, impacting confidentiality, integrity, and availability. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can take over Oracle Commerce Guided Search and Experience Manager instances over HTTP, leading to full compromise of the application and its data.

Affected Products

Oracle Commerce Guided Search 11.4.0
Oracle Commerce Experience Manager 11.4.0
Endeca Application Controller component

Discovery Timeline

2026-07-21 - CVE-2026-61161 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-61161

Vulnerability Analysis

The vulnerability resides in the Endeca Application Controller, the administrative service that manages Endeca MDEX Engine instances, Dgraph processes, and application deployment tasks in Oracle Commerce Guided Search. The flaw is remotely exploitable over HTTP without authentication or user interaction, and attack complexity is low. A single crafted network request is sufficient to compromise the service.

According to Oracle's advisory, successful attacks result in takeover of Oracle Commerce Guided Search and Oracle Commerce Experience Manager. This indicates full control over the affected application scope, including the ability to read, modify, or destroy indexed catalog data and configuration used by production commerce storefronts.

See the Oracle Critical Patch Update advisory for the authoritative technical description.

Root Cause

Oracle has not published a public root-cause analysis or CWE mapping for this issue. Historically, the Endeca Application Controller exposes management endpoints that accept administrative commands; missing authentication or improper input validation on these endpoints is consistent with the observed exploitation profile. The advisory confirms no privileges are required and no user interaction is needed.

Attack Vector

An attacker sends crafted HTTP requests to a network-reachable Endeca Application Controller endpoint. Because privileges are not required and the attack complexity is low, exposed instances can be compromised directly from the internet or from any adjacent network segment with HTTP reachability. Post-exploitation impact spans confidentiality, integrity, and availability of the Commerce Guided Search environment.

No verified public proof-of-concept code is available at the time of publication. Refer to the vendor advisory for exploitation prerequisites and patched behavior.

Detection Methods for CVE-2026-61161

Indicators of Compromise

Unexpected HTTP requests to Endeca Application Controller management endpoints from untrusted sources
Unauthorized deployment, provisioning, or shutdown events in Endeca Application Controller logs
New or modified Dgraph processes, application definitions, or scripts created outside of change-management windows
Outbound network connections initiated by the Endeca Application Controller host to unknown IP addresses

Detection Strategies

Monitor web server and application logs on Endeca hosts for anomalous HTTP verbs, unusual URIs, or requests bypassing normal administrative workflows
Alert on process creation on Endeca hosts where the parent is the Application Controller service and the child is a shell, scripting interpreter, or reconnaissance binary
Baseline expected administrative source IPs and flag any HTTP access from outside that set

Monitoring Recommendations

Forward Endeca Application Controller logs, host process telemetry, and network flows to a centralized analytics platform for correlation
Track integrity of Endeca configuration files and application deployment artifacts with file integrity monitoring
Review authentication and administrative activity for the Commerce Guided Search environment daily until patching is confirmed

How to Mitigate CVE-2026-61161

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes for Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 without delay
Inventory all Endeca deployments and confirm which instances expose the Application Controller to untrusted networks
Restrict inbound HTTP access to the Endeca Application Controller to a small set of trusted administrative hosts using firewall or ACL rules
Rotate credentials, API keys, and secrets stored on or reachable from Endeca hosts if compromise is suspected

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should follow the Oracle Critical Patch Update advisory for patch identifiers, download locations, and installation prerequisites. Apply the update in a staged environment first, then promote to production.

Workarounds

Block external HTTP access to the Endeca Application Controller port at the network perimeter until patches are applied
Place the Application Controller behind an authenticating reverse proxy that enforces IP allow-listing and TLS client authentication
Disable the Application Controller service on hosts that do not require it for active deployment operations

bash

# Example: restrict Endeca Application Controller access with iptables
# Replace ADMIN_SUBNET and EAC_PORT with your environment values
iptables -A INPUT -p tcp --dport EAC_PORT -s ADMIN_SUBNET -j ACCEPT
iptables -A INPUT -p tcp --dport EAC_PORT -j DROP