NCSC-2026-0255 [1.00] [M/H] Vulnerabilities fixed in Oracle Commerce Platform
Oracle has fixed 39 vulnerabilities in Oracle Commerce Platform and Oracle Commerce Guided Search/Experience Manager, both version 11.4.0. 11 of these vulnerabilities have received a CVSS score of 9 or higher and are summarized below. The remaining vulnerabilities have lower scores, and detailed information is not included in this advisory. For this, the NCSC refers to the references. The vulnerabilities in Oracle Commerce Platform 11.4.0 allow unauthenticated attackers to gain unauthorized access to sensitive data, modify critical data, or cause full system compromise by executing arbitrary code via network access and HTTP or LDAP protocols. Some vulnerabilities require user interaction, while others do not. Additionally, attackers can cause denial-of-service by exhausting system resources or crashing the system. The Oracle Commerce Guided Search and Experience Manager modules contain similar vulnerabilities that allow unauthenticated attackers with network access via HTTP or RMI to gain full control over the system, access sensitive information, manipulate data, or cause denial-of-service. The vulnerabilities are related to insufficient access control, authentication bypass, and improper handling of network requests. The CVSS scores of these vulnerabilities range from 5.4 to 9.9, with multiple vulnerabilities scoring 9.8 or higher, indicating potential for full system compromise without authentication.
CSIRTS triage
- What
- Vulnerabilities allow unauthenticated attackers to gain unauthorized access to sensitive data and execute arbitrary code.
- Who is affected
- Deployments of Oracle Commerce Platform and Oracle Commerce Guided Search/Experience Manager version 11.4.0.
- Urgency
- Remediation is critical due to the potential for complete system compromise and denial of service.
- Action
- Update to the latest version of Oracle Commerce Platform.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Oracle Commerce Platform
Get an email when a new Oracle Commerce Platform advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0255
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-41760.68% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all scored CVEs.
- Low exploitation riskCVE-2026-33810.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.
- Low exploitation riskCVE-2026-271710.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all scored CVEs.
- Low exploitation riskCVE-2026-611290.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all scored CVEs.
- Low exploitation riskCVE-2026-611300.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all scored CVEs.
- Low exploitation riskCVE-2026-611310.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all scored CVEs.
- Low exploitation riskCVE-2026-611450.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all scored CVEs.
- Low exploitation riskCVE-2026-611460.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.
- Low exploitation riskCVE-2026-611530.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all scored CVEs.
- Low exploitation riskCVE-2026-611540.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-4176 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-3381 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-27171 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-61129 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-61130 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-61131 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-61145 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-61146 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-61153 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-61154 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-61155 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-61156 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-61161 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Oracle Communications: Multiple vulnerabilitiescert-bund
- unknownMultiple vulnerabilities in IBM products (July 24, 2026)cert-fr-avis
- unknownNCSC-2026-0256 [1.00] [M/H] Vulnerabilities fixed in Oracle Communicationsncsc-nl
- unknownNCSC-2026-0254 [1.00] [M/H] Vulnerabilities fixed in Oracle database productsncsc-nl
- low[UPDATE] [low] zlib: Vulnerability allows Denial of Servicecert-bund
- high[NEW] [high] Oracle Commerce: Multiple vulnerabilitiescert-bund
- high[NEW] [high] Oracle TimesTen In-Memory Database: Multiple vulnerabilitiescert-bund
- criticalCVE-2026-61161: Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager produc…nvd
- criticalCVE-2026-61156: Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerc…nvd
- criticalCVE-2026-61155: Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerc…nvd
- criticalCVE-2026-61154: Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerc…nvd
- criticalCVE-2026-61153: Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager produc…nvd
Recent advisories for Oracle Commerce Platform
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- highCVE-2026-61165: Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerc…nvd · 2026-07-21
- criticalCVE-2026-61156: Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerc…nvd · 2026-07-21
- criticalCVE-2026-61155: Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerc…nvd · 2026-07-21
- criticalCVE-2026-61154: Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerc…nvd · 2026-07-21
- highCVE-2026-61137: Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Ap…nvd · 2026-07-21
- highCVE-2026-61136: Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Ap…nvd · 2026-07-21
More from NCSC-NL Advisories
- unknownNCSC-2026-0274 [1.00] [M/H] Kwetsbaarheid verholpen in SolarWinds Web Help Desk2026-07-31
- unknownNCSC-2026-0273 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Campaign Classic2026-07-31
- unknownNCSC-2026-0272 [1.00] [M/H] Kwetsbaarheden verholpen in JFrog Artifactory2026-07-31
- unknownNCSC-2026-0271 [1.00] [M/H] Vulnerability fixed in Cisco Secure Firewall Management Center2026-07-30
- unknownNCSC-2026-0270 [1.00] [M/M] Vulnerabilities fixed in GitLab by GitLab Inc.2026-07-30