SB2026110749 - Multiple vulnerabilities in Oracle Commerce Platform
Published: November 7, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 vulnerabilities.
1) Improper validation of certificate with host mismatch (CVE-ID: CVE-2025-68161)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N]
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to the Socket Appender does not perform TLS hostname verification of the peer certificate, even when the "verifyHostName" configuration attribute or the "log4j2.sslVerifyHostName" system property is set to true. A remote attacker can perform MitM attack and intercept or redirect the log traffic.
2) Uncontrolled recursion (CVE-ID: CVE-2026-27601)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to an uncontrolled recursion within the _.flatten() and _.isEqual() function. A remote attacker can pass specially crafted input to the application and perform a denial of service attack.
3) Improper input validation (CVE-ID: CVE-2026-61134)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated user to read and manipulate data.
The vulnerability exists due to improper input validation within the Dynamo Application Framework component in Oracle Commerce Platform. A remote authenticated user can exploit this vulnerability to read and manipulate data.
4) Improper input validation (CVE-ID: CVE-2026-61136)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the Dynamo Application Framework component in Oracle Commerce Platform. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
5) Improper input validation (CVE-ID: CVE-2026-61135)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the Dynamo Application Framework component in Oracle Commerce Platform. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
6) Improper input validation (CVE-ID: CVE-2026-61133)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation within the Dynamo Application Framework component in Oracle Commerce Platform. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
7) Input validation error (CVE-ID: CVE-2026-42403)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in the policy normalization process when parsing WS-Policy documents containing circular policy references. A remote attacker can supply a specially crafted policy document to cause a denial of service.
The issue can result in an infinite loop, excessive recursion, a stack overflow, or an application hang.
8) Improper input validation (CVE-ID: CVE-2026-61132)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated user to read and manipulate data.
The vulnerability exists due to improper input validation within the Dynamo Application Framework component in Oracle Commerce Platform. A remote authenticated user can exploit this vulnerability to read and manipulate data.
9) Improper input validation (CVE-ID: CVE-2026-61137)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to improper input validation within the Dynamo Application Framework component in Oracle Commerce Platform. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.
10) Improper input validation (CVE-ID: CVE-2026-61130)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to read data or crash the application.
The vulnerability exists due to improper input validation within the Dynamo Application Framework component in Oracle Commerce Platform. A remote non-authenticated attacker can exploit this vulnerability to read data or crash the application.
11) Improper input validation (CVE-ID: CVE-2026-61131)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to improper input validation within the Dynamo Application Framework component in Oracle Commerce Platform. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.
12) Improper input validation (CVE-ID: CVE-2026-61129)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to improper input validation within the ATG Portals component in Oracle Commerce Platform. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.
Remediation
Install update from vendor's website.