CVE-2026-61165: Oracle Commerce Guided Search DoS Flaw

CVE-2026-61165 Overview

CVE-2026-61165 affects the Oracle Commerce Guided Search Platform Services product within Oracle Commerce, specifically the Forge component. The supported and affected version is 11.4.0. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise the service. Successful exploitation can cause a hang or frequently repeatable crash, resulting in a complete denial of service. Attackers can also gain unauthorized read access to a subset of accessible data. Oracle disclosed the issue in the Oracle Critical Patch Update advisory for July 2026.

Critical Impact
A low-privileged, network-adjacent attacker can trigger a complete denial of service and read a subset of data from Oracle Commerce Guided Search Platform Services.

Affected Products

Oracle Commerce Guided Search Platform Services 11.4.0
Oracle Commerce Forge component
Deployments exposing the service to HTTP-accessible networks

Discovery Timeline

2026-07-21 - CVE-2026-61165 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update advisory

Technical Details for CVE-2026-61165

Vulnerability Analysis

The vulnerability resides in the Forge component of Oracle Commerce Guided Search Platform Services. Forge is responsible for data processing pipelines that build search indexes for the Guided Search platform. An authenticated attacker with low privileges can send crafted HTTP requests over the network to trigger the flaw. The condition results in two distinct impacts: an availability impact producing a hang or repeatable crash, and a confidentiality impact exposing a subset of accessible data. The Oracle advisory categorizes the issue with confidentiality and availability impacts and no integrity impact. See the Oracle Security Alert July 2026 for vendor-authoritative details. The EPSS probability of exploitation is 0.365% at the 28.99 percentile.

Root Cause

Oracle has not published the underlying weakness class or CWE mapping for this issue. Based on the impact profile, the flaw is consistent with an input handling defect in Forge that both crashes the service and returns unintended data to the requester. Refer to the Oracle Security Alert July 2026 for authoritative technical scope.

Attack Vector

Exploitation requires network access via HTTP and valid low-privileged credentials to the Guided Search Platform Services instance. No user interaction is required. The attacker sends crafted requests to the Forge component to trigger the denial of service and information disclosure conditions. The vulnerability is described by Oracle as easily exploitable.

No verified proof-of-concept code is publicly available. The vulnerability mechanism is described in prose in accordance with the Oracle advisory; see the Oracle Security Alert July 2026 for further guidance.

Detection Methods for CVE-2026-61165

Indicators of Compromise

Unexpected crashes, hangs, or restarts of the Forge process on Oracle Commerce Guided Search Platform Services hosts.
Anomalous HTTP request patterns targeting Forge endpoints from low-privileged accounts.
Sudden gaps or errors in Guided Search indexing jobs correlated with inbound HTTP activity.

Detection Strategies

Monitor Oracle Commerce application and system logs for repeated Forge component faults or abnormal termination events.
Correlate HTTP access logs with authentication events to identify low-privileged accounts issuing unusual request volumes.
Alert on repeated 5xx responses or process restarts originating from a narrow set of source IPs.

Monitoring Recommendations

Track process health and uptime metrics for the Forge service and alert on crash loops.
Ingest Oracle Commerce logs into a centralized SIEM or data lake for correlation with authentication and network telemetry.
Baseline normal request rates to Guided Search endpoints and flag statistical deviations from authenticated users.

How to Mitigate CVE-2026-61165

Immediate Actions Required

Apply the fixes provided in the Oracle Critical Patch Update for July 2026 to all instances running Oracle Commerce Guided Search Platform Services 11.4.0.
Inventory Oracle Commerce deployments and confirm which hosts run the affected Forge component.
Review and reduce the population of low-privileged accounts with network access to the service.

Patch Information

Oracle addressed CVE-2026-61165 in the July 2026 Critical Patch Update. Administrators should follow the remediation guidance in the Oracle Security Alert July 2026 and apply the referenced patches to Oracle Commerce Guided Search Platform Services 11.4.0.

Workarounds

Restrict HTTP access to Guided Search Platform Services to trusted management networks until patches are applied.
Enforce network segmentation and firewall rules so only authorized systems can reach the Forge component.
Rotate and audit credentials for accounts able to authenticate to the service, removing unused low-privileged accounts.

bash

# Configuration example: restrict HTTP access to trusted subnets
# Replace 10.0.0.0/24 with your authorized management network
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP