---
id: "CVE-2026-101560"
kind: "vulnerability"
aliases: ["CVE-2026-101560"]
title: "Oracle Commerce Platform: low-privilege network attacker can modify critical data"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["dynamo-commerce-server", "oracle-commerce", "self-hosted", "vendor"]
not_affected_if: ["not-version-11.4.0"]
published_at: "2026-10-20T22:18:07+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:34:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101560", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle Commerce Platform: low-privilege network attacker can modify critical data

Oracle Commerce Platform's Dynamo Commerce Server component, version 11.4.0, has a flaw reachable over HTTP. An attacker with low-privilege access can create, modify or delete critical data and read a subset of the platform's data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle Commerce Platform version against `11.4.0`
- unknown

## Fix

- Apply the Oracle Critical Patch Update for Oracle Commerce Platform; the patched version is unknown from the sources

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101560

## From the sources

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Commerce Server).   The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Platform.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Platform accessible data as well as  unauthorized read access to a subset of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_