CVE-2026-61162 Overview
CVE-2026-61162 affects Oracle Commerce Guided Search and Oracle Commerce Experience Manager version 11.4.0. The vulnerability resides in the Endeca Application Controller component. A low-privileged attacker with local logon access to the infrastructure hosting the product can compromise confidentiality and integrity of application data.
Successful exploitation permits unauthorized creation, modification, or deletion of critical data. Attackers also gain unauthorized read access to all data accessible by the affected product. Oracle disclosed the issue in the July 2026 Critical Patch Update.
Critical Impact
An authenticated local attacker can read, modify, or delete all data accessible to Oracle Commerce Guided Search / Experience Manager, undermining catalog and search integrity.
Affected Products
- Oracle Commerce Guided Search 11.4.0
- Oracle Commerce Experience Manager 11.4.0
- Endeca Application Controller component
Discovery Timeline
- 2026-07-21 - CVE-2026-61162 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Addressed in Oracle CPU July 2026 Security Alert
Technical Details for CVE-2026-61162
Vulnerability Analysis
The flaw exists in the Endeca Application Controller (EAC), the management service that orchestrates Oracle Commerce Guided Search deployments. The EAC coordinates indexing, data ingestion, and application configuration across Endeca servers.
An attacker who can log on to the infrastructure running the product can abuse EAC operations to reach data and control functions beyond their assigned privileges. The attack requires local access and low privileges, with no user interaction and low attack complexity.
Impact concentrates on confidentiality and integrity. Availability is not affected, indicating the vulnerability enables data disclosure and unauthorized modification rather than service disruption. The EPSS score is 0.149% at the time of publication, reflecting limited observed exploitation activity.
Root Cause
Oracle has not released detailed technical information about the underlying weakness. Based on the disclosed impact profile, the issue involves improper access control or authorization within EAC operations. Low-privileged users can invoke functions or reach resources that should be restricted to higher-privileged roles.
Attack Vector
The attack vector is local. The attacker must first authenticate to the host or infrastructure where Oracle Commerce Guided Search or Experience Manager executes. Once logged on with any low-privileged account, the attacker interacts with EAC to reach unauthorized data or perform unauthorized write operations. The vulnerability manifests through the controller's handling of privileged operations. See the Oracle CPU July 2026 Security Alert for authoritative technical details.
Detection Methods for CVE-2026-61162
Indicators of Compromise
- Unexpected changes to Endeca application configuration, indexes, or catalog data initiated by non-administrative accounts.
- EAC command invocations originating from user contexts that do not normally interact with the controller.
- Unusual read access patterns against Endeca data stores or MDEX engines from local shell sessions.
Detection Strategies
- Audit EAC logs (eac.log, eac-cmd.log) for administrative operations run by low-privileged local accounts.
- Correlate local logon events on Endeca hosts with subsequent EAC or runcommand script executions.
- Baseline expected users of the Endeca administrative tooling and alert on deviations.
Monitoring Recommendations
- Forward host authentication events and EAC application logs to a centralized log platform for retention and correlation.
- Monitor filesystem changes under Endeca installation directories, particularly config, data, and state folders.
- Alert on execution of eaccmd, runcommand.sh, or runcommand.bat outside change-management windows.
How to Mitigate CVE-2026-61162
Immediate Actions Required
- Apply the fixes contained in the Oracle Critical Patch Update for July 2026 to all affected Oracle Commerce Guided Search 11.4.0 and Experience Manager 11.4.0 deployments.
- Inventory all hosts running the Endeca Application Controller and confirm patch coverage.
- Review and reduce the set of local accounts with logon rights to Endeca servers.
Patch Information
Oracle addressed CVE-2026-61162 in the July 2026 Critical Patch Update. Administrators should review the Oracle CPU July 2026 Security Alert and apply the corresponding patch bundle for Oracle Commerce 11.4.0. Restart the EAC service after applying the update.
Workarounds
- Restrict interactive and remote logon to Endeca hosts to administrators only using OS-level access controls.
- Segment Endeca infrastructure on a dedicated network and enforce jump-host access with multi-factor authentication.
- Rotate credentials for any local accounts that had access to affected hosts prior to patching.
# Example: restrict interactive logon on Linux Endeca hosts to a dedicated admin group
sudo groupadd endeca-admins
sudo usermod -aG endeca-admins <admin-user>
# /etc/security/access.conf
-:ALL EXCEPT root endeca-admins:ALL
# Verify EAC service ownership and directory permissions
sudo chown -R endeca:endeca /opt/endeca/PlatformServices
sudo chmod -R 750 /opt/endeca/PlatformServices
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
