Commerce Platform vulnerabilities

13 known vulnerabilities in Commerce Platform from Oracle. 13 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Oracle Commerce Platform: Improper Access Control

  CVE-2026-70955Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical

• 9.8 Critical severity

  Oracle Commerce Platform: Missing Authentication for Critical Functionality

  CVE-2026-70954Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP

• 9.8 Critical severity

  Oracle Commerce Platform: Missing Authentication for Critical Functionality

  CVE-2026-70953Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP t

• 8.1 High severity

  Oracle Commerce Platform: Improper Authentication

  CVE-2026-61137Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTT

• 7.3 High severity

  Oracle Commerce Platform: Improper Access Control

  CVE-2026-61136Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP

• 7.4 High severity

  Oracle Commerce Platform: Improper Access Control

  CVE-2026-61135Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTT

• 7.5 High severity

  Oracle Commerce Platform: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-61133Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP

• 7.6 High severity

  Oracle Commerce Platform: Cross-Site Request Forgery

  CVE-2026-61132Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP t

• 9.8 Critical severity

  Oracle Commerce Platform: Improper Access Control

  CVE-2026-61131Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP

• 9.1 Critical severity

  Oracle Commerce Platform: Improper Access Control

  CVE-2026-61130Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP

• 9.8 Critical severity

  Oracle Commerce Platform: Improper Authentication

  CVE-2026-61129Jul 21, 2026Oracle

  Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: ATG Portals). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Ora

• 9.8 Critical severity

  Spring Framework JDK 9+ Remote Code Execution Exploited

  CVE-2022-22965Apr 1, 2022Spring FrameworkEPSS 99.6%

  A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot

• 9.8 Critical severity

  Oracle Multiple Products Remote Code Execution Exploited

  CVE-2020-2555Jan 15, 2020OracleEPSS 97.1%

  Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticat