What is the CVSS score of CVE-2026-60209?

CVE-2026-60209 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60209?

Oracle Coherence (versions 12.2.1.4.0-15.1.1.0.0) can be remotely compromised without authentication, enabling complete system takeover via a CRITICAL vulnerability with 9.8 severity.

How to fix or mitigate CVE-2026-60209?

Within 24 hours: Identify all systems running vulnerable Coherence versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) across Oracle Fusion, WebLogic, and Coherence deployments, document their network exposure, and escalate to your Oracle support account for patch timeline confirmation. Within 7 days: Implement firewall rules restricting Coherence cluster ports (typically 7574 and 9099) to only trusted internal networks, enable comprehensive logging and alerting on all Coherence traffic for anomaly detection, and assess business criticality of each instance to determine if temporary shutdown is feasible to reduce attack surface. Within 30 days: Maintain weekly contact with Oracle support for patch status, establish and test incident response procedures for compromise scenarios, and prepare a staged patching plan for immediate deployment upon vendor release.

Oracle Coherence CVE-2026-60209

EUVD-2026-46615 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-q7j4-445q-2c43

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:58 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence (Fusion Middleware Core) is achievable by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 9.8 with complete confidentiality, integrity, and availability impact against supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch item.