This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable remotely over HTTP by unauthenticated attackers due to insufficient access controls or other security weaknesses in the Experience Manager component. Successful exploitation results in unauthorized access to sensitive or all accessible data within the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact with no integrity or availability impact. The vendor advisory from Oracle (July 2026 Critical Patch Update) lists this vulnerability among many others but does not explicitly confirm patch availability or remediation details for this specific issue. Customers are strongly advised to apply Oracle Critical Patch Updates promptly to mitigate such vulnerabilities.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical or all data accessible through Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. This compromises confidentiality but does not affect integrity or availability. The impact is high due to potential exposure of sensitive business or customer data.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm patch availability or remediation status for CVE-2026-61157. Customers should review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply all relevant security patches without delay. Until a patch is applied, restrict network access to the affected service where possible to reduce exposure.