This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Content Acquisition System component) version 11.4.0. It is easily exploitable by an attacker with low privileges and network access over HTTP, enabling complete takeover of the affected product. The vulnerability's scope may extend to other Oracle products due to potential impact from successful exploitation. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. The vendor advisory is part of Oracle's July 2026 Critical Patch Update but does not explicitly confirm the availability of a patch for this specific vulnerability.

Successful exploitation results in complete compromise of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, with high impact on confidentiality, integrity, and availability. The vulnerability may also affect additional Oracle products due to scope change, potentially leading to broader security consequences within affected environments.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to address vulnerabilities. However, the advisory does not explicitly confirm a patch for CVE-2026-61146. Therefore, patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Until a patch is confirmed and applied, restrict network access to the affected service where possible and monitor for unusual activity related to Oracle Commerce Guided Search / Experience Manager.