Threat Intelligence Database

CVE-2026-61165 is a high-severity vulnerability in Oracle Commerce Guided Search Platform Services version 11.4.0. It allows a low privileged attacker with network access via HTTP to cause a denial of service by hanging or crashing the service and to gain unauthorized read access to some accessible data. The vulnerability impacts confidentiality and availability but not integrity. No official patch or fix status is explicitly confirmed in the vendor advisory. Oracle recommends applying security patches promptly, but this specific vulnerability's patch status should be verified in the referenced Critical Patch Update advisory.

CVE-2026-61156 is a critical vulnerability in Oracle Commerce Guided Search Platform Services version 11.4.0. It allows an unauthenticated attacker with network access via HTTPS to compromise the platform services. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, resulting in full access to all accessible data within the platform services. The vulnerability has a CVSS 3.1 base score of 9.1, indicating high confidentiality and integrity impacts without availability impact.

CVE-2026-61155 is a critical vulnerability in Oracle Commerce Guided Search Platform Services version 11.4.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data or cause a denial of service by hanging or crashing the service. The vulnerability has a CVSS 3.1 base score of 9.1, indicating high confidentiality and availability impacts. No official patch or remediation level has been explicitly stated in the vendor advisory as of the published date. Oracle recommends applying security patches promptly and staying on supported versions. The vendor advisory references a Critical Patch Update released in July 2026, but does not explicitly confirm a patch for this specific vulnerability in the provided content.

CVE-2026-61154 is a critical vulnerability in Oracle Commerce Guided Search Platform Services version 11.4.0. It allows an unauthenticated attacker with network access via HTTP to fully compromise the service, resulting in complete takeover. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability.