{"id":"CVE-2026-101560","kind":"vulnerability","aliases":["CVE-2026-101560"],"related":[],"title":"Oracle Commerce Platform: low-privilege network attacker can modify critical data","description":"Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Commerce Server).   The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Platform.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Platform accessible data as well as  unauthorized read access to a subset of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).","summary":"Oracle Commerce Platform's Dynamo Commerce Server component, version 11.4.0, has a flaw reachable over HTTP. An attacker with low-privilege access can create, modify or delete critical data and read a subset of the platform's data.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dynamo-commerce-server","oracle-commerce","self-hosted","vendor"],"not_affected_if":["not-version-11.4.0"],"how_to_check":"- Check the installed Oracle Commerce Platform version against `11.4.0`\n- unknown","fix":"- Apply the Oracle Critical Patch Update for Oracle Commerce Platform; the patched version is unknown from the sources","status":"open","published_at":"2026-10-20T22:18:07+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:34:30+00:00","updated_at":"2026-10-25T03:34:30+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:34:30Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for Oracle Commerce Platform; the patched version is unknown from the sources","reach":"network","title":"Oracle Commerce Platform: low-privilege network attacker can modify critical data","impact":"high","summary":"Oracle Commerce Platform's Dynamo Commerce Server component, version 11.4.0, has a flaw reachable over HTTP. An attacker with low-privilege access can create, modify or delete critical data and read a subset of the platform's data.","category":"vendor","nicknames":[],"who_cares":["oracle-commerce","dynamo-commerce-server","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker modifies or deletes critical commerce data and reads some","analyst_note":"Check Oracle's Critical Patch Update advisory for the patched version and any required configuration; the sources give only the CVSS vector.","how_to_check":"- Check the installed Oracle Commerce Platform version against `11.4.0`\n- unknown","needs_analyst":true,"not_affected_if":["not-version-11.4.0"],"who_is_affected":"Deployments of Oracle Commerce Platform 11.4.0 that expose the Dynamo Commerce Server over HTTP to the network are affected. Systems that do not run this version, or do not expose it to the network, are less exposed. The sources do not say which configurations are required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000614,"input_tokens":3504,"output_tokens":527,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101560':15A,18A '-2026':14A,17A '/av':160C '11.4.0':39B,90C '3.1':148C,159C '7.1':151C 'access':52B,100C,121C,130C,137C,145C 'affect':88C 'allow':94C 'attack':8A,47B,97C,109C 'base':149C 'commerc':2A,21B,25B,31B,35B,73C,78C,81C,106C,128C,143C 'compon':37B,79C 'compromis':104C 'confidenti':152C 'creat':54B 'creation':117C 'critic':11A,58B,123C 'cve':13A,16A 'cvss':147C,156C,158C 'data':12A,59B,68B,124C,131C,146C 'delet':57B,118C 'dynamo':20B,34B,80C 'dynamo-commerce-serv':19B 'easili':91C 'exploit':92C 'flaw':42B 'h/a':167C 'host':28B 'http':45B,102C 'impact':155C 'integr':154C 'l/i':166C 'l/pr':162C 'l/ui':163C 'low':5A,50B,95C 'low-privileg':4A,49B 'modif':120C 'modifi':10A,55B 'n':168C 'n/ac':161C 'n/s':164C 'network':7A,99C 'oracl':1A,24B,30B,72C,77C,105C,127C,142C 'oracle-commerc':23B 'platform':3A,32B,66B,74C,107C,129C,144C 'privileg':6A,51B,96C 'product':75C 'reachabl':43B 'read':61B,136C 'result':114C 'score':150C 'self':27B 'self-host':26B 'server':22B,36B,82C 'subset':63B,140C 'success':108C 'support':84C 'u/c':165C 'unauthor':116C,135C 'vector':157C 'vendor':29B 'version':38B,85C 'via':101C 'vulner':69C,93C,112C 'well':133C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Oracle Commerce Platform 11.4.0 that expose the Dynamo Commerce Server over HTTP to the network are affected. Systems that do not run this version, or do not expose it to the network, are less exposed. The sources do not say which configurations are required.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101560","severity":null,"published_at":"2026-10-20T22:18:07+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}