OracleCVE-2026-70953
Oracle Commerce Platform: takeover via Dynamo Application Framework
Critical9.8CVE-2026-70953 · Published Aug 18, 2026 · updated Sep 1, 2026
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Oracle Commerce Platform Product | <= 11.4.0 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-306
More Oracle advisories
All Oracle| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 18 | Helidon: data tampering via Imperative Web Server | High8.6 | No fix yet |
| Aug 18 | Helidon: data tampering via Imperative Web Server | Critical9.9 | No fix yet |
| Aug 18 | Helidon: data tampering via Imperative Web Server | High8.3 | No fix yet |
| Aug 18 | Helidon: flaw in Imperative Web Server | Medium5.3 | No fix yet |
| Aug 18 | Helidon: data tampering via Imperative Web Server | High7.3 | No fix yet |
| Aug 18 | Helidon: denial of service via Imperative Web Server | High7.5 | No fix yet |