CVE-2026-61155 affects Oracle Commerce Guided Search Platform Services (component: Forge) version 11.4.0. It is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise the service. Successful exploitation can lead to unauthorized access to all accessible data within the service and the ability to cause a hang or frequent crashes, resulting in a complete denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact. The vendor advisory linked is a general Critical Patch Update for July 2026 but does not explicitly confirm a patch or remediation for this vulnerability in the provided excerpt.

The vulnerability allows unauthenticated remote attackers to access critical data without authorization and to cause denial of service conditions by hanging or crashing the Oracle Commerce Guided Search Platform Services. This impacts confidentiality and availability severely, as indicated by the CVSS score of 9.1. There is no indication of integrity impact. No known exploits in the wild have been reported as of the publication date.

The vendor advisory does not explicitly confirm a patch or remediation for CVE-2026-61155 in the provided content. Oracle recommends that customers remain on actively supported versions and apply security patches promptly. Users of Oracle Commerce Guided Search Platform Services version 11.4.0 should monitor Oracle's Critical Patch Update advisories and apply any relevant patches as soon as they become available. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.