Live › vulnerability › CVE-2026-101560
Go to dashboardOracle Commerce Platform's Dynamo Commerce Server component, version 11.4.0, has a flaw reachable over HTTP. An attacker with low-privilege access can create, modify or delete critical data and read a subset of the platform's data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Oracle Commerce Platform 11.4.0 that expose the Dynamo Commerce Server over HTTP to the network are affected. Systems that do not run this version, or do not expose it to the network, are less exposed. The sources do not say which configurations are required.
No product ranges from the sources yet.
11.4.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Commerce Server). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Platform accessible data as well as unauthorized read access to a subset of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101560")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.