Cyber Resilience

CVE-2026-61135

Access Control in Oracle Commerce Platform 11.4.0

Published
21 July 2026
Modified
27 July 2026
Patch / advisory
CVSS Score v3.1 7.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0032 24th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-61135 is a high-severity Improper Access Control (CWE-284) vulnerability in Oracle Commerce Platform. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-8 (Identification and Authentication (Non-organizational Users)) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful…

more

attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Platform accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Vulnerability in a public-facing Oracle Commerce web application allows unauthenticated remote exploitation over HTTP, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-61130Same product: Oracle Commerce Platform
CVE-2026-61131Same product: Oracle Commerce Platform
CVE-2026-61129Same product: Oracle Commerce Platform
CVE-2026-61137Same product: Oracle Commerce Platform
CVE-2026-61140Same vendor: Oracle
CVE-2026-61171Same vendor: Oracle
CVE-2026-46920Same vendor: Oracle
CVE-2026-61158Same vendor: Oracle
CVE-2026-60880Same vendor: Oracle
CVE-2026-46902Same vendor: Oracle

Affected Assets

oracle
commerce platform
11.4.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • IA-8 Identification and Authentication (Non-organizational Users)
  • AC-6 Least Privilege
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 14 hardening rules · 4 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V10.3.5
  • V6.2.3
  • V6.4.4
  • V10.4.16

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces access control policies to block unauthenticated HTTP requests from performing create/delete/modify operations on critical data (CWE-284).

prevent

Requires identification and authentication for non-organizational users before allowing access to critical functions (CWE-306).

prevent

Limits the scope of damage an unauthenticated attacker could cause even if authentication enforcement is bypassed.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 full match
prevents

Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.

PR.AA-05 mostly match
prevents

PR.AA-05 directly enforces policy-based access management and least privilege, eliminating most improper-access-control defects, yet CWE-284 also covers implementation flaws and design gaps outside a single management control.

PR.PS-01 mostly match
prevents

Hardened baselines and deviation monitoring directly eliminate most configuration-induced access-control defects, yet CWE-284 also encompasses code-level and design flaws outside the scope of configuration management alone.

PR.PS-06 mostly match
prevents

Secure SDLC practices catch most access-control defects during design/coding/testing (mostly), yet leave residual risk from runtime configuration, architecture, and operational controls (partial).

PR.AA-01 partial match
prevents

PR.AA-01 supplies managed identities/credentials that support but do not implement access-control decisions, so it only partially prevents CWE-284 in either direction.

PR.DS-01 partial match
prevents

PR.DS-01 encryption mitigates impact of failed access checks on stored data but neither implements nor constrains access-control logic itself.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Defining and enforcing explicit access rights and restrictions for each entity directly stops the assignment of permissions that exceed what is required, eliminating the root condition that allows improper access control.

prevents

Formal authorization, role-based provisioning, and timely revocation of access rights directly stop the creation of accounts or permissions that exceed what the business actually needs.

prevents

By enforcing explicit rules on which identities or groups may perform read, write, delete or execute operations and by denying anonymous access to sensitive data, the control directly stops the creation of overly permissive or missing access-control checks.

prevents

The control explicitly calls for authentication before any critical function is reached, eliminating the possibility of bypassing authentication for high-value operations.

prevents

Requiring one-to-one mapping of identities to entities and timely removal of unused identities directly stops attackers from leveraging stale or shared accounts to bypass access restrictions.

prevents

By explicitly transferring security roles and responsibilities when personnel change jobs or leave, the control reduces the chance that former employees retain access rights they no longer need, thereby limiting improper access control.

References