This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is easily exploitable by an attacker with low privileges and network access via HTTP, allowing compromise and potential takeover of the affected product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. The vulnerability is listed in Oracle's July 2026 Critical Patch Update advisory, which addresses many security issues across Oracle products. The advisory recommends applying security patches promptly but does not explicitly confirm a patch for this vulnerability. No public exploits are known.

Successful exploitation can lead to complete compromise of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access and control over the system's functions and data.

Oracle's July 2026 Critical Patch Update advisory includes security patches for multiple products and strongly recommends applying patches without delay. However, the advisory does not explicitly confirm the availability of a patch for CVE-2026-61149. Users should monitor Oracle's official security alerts and apply any relevant patches as soon as they become available. Until a patch is confirmed, restrict network access to the affected service where possible and follow Oracle's general security recommendations. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance: https://www.oracle.com/security-alerts/cpujul2026.html