What is the CVSS score of CVE-2026-60210?

CVE-2026-60210 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60210?

Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are vulnerable to unauthenticated remote complete system takeover via CVE-2026-60210 (CVSS 9.8), with no vendor-released patch…

How to fix or mitigate CVE-2026-60210?

Within 24 hours, execute an inventory of all Oracle Coherence deployments, documenting affected versions (14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) and network exposure; immediately restrict TCP access to the Coherence Core component to only trusted internal systems and isolate any instances with internet-facing exposure. Within 7 days, complete risk assessment of each affected deployment, document business-critical dependencies, and establish urgent escalation with Oracle support to track patch release status and identify upgrade paths to unaffected versions (14.1.3.0.0 or later, 15.1.2.0.0 or later) or architectural alternatives. Within 30 days, execute mitigation for all affected systems through patching, network segmentation, or architectural redesign, validate remediation, and implement permanent network access controls ensuring Coherence Core is never directly accessible from untrusted networks.

Oracle Coherence CVE-2026-60210

EUVD-2026-46616 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-8p6m-w3wg-j3c3

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description states unauthenticated TCP network access with low complexity leading to full Coherence takeover, so AV:N/AC:L/PR:N/UI:N with High C/I/A.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:58 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access to the Core component exploits an easily-exploitable flaw in versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Disclosed by Oracle in the July 2026 Critical Patch Update, the issue carries a CVSS 9.8 score with full confidentiality, integrity, and availability impact and requires no user interaction. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; however, the low attack complexity and unauthenticated network reachability make it a high-priority patch.

Technical ContextAI

Oracle Coherence is an in-memory distributed data grid and caching platform bundled within Oracle Fusion Middleware and commonly deployed alongside Oracle WebLogic Server for scalable, clustered application state management. The vulnerability resides in the Core component, which handles cluster communication and data serialization over TCP. Oracle assigned no CWE (CWE: N/A), but historic Coherence takeover flaws of this profile typically stem from unsafe deserialization of untrusted data reaching internal cluster/proxy listener ports; the CPE cpe:2.3:a:oracle_corporation:oracle_coherence identifies Oracle Coherence as the sole affected product. The 'takeover' outcome with full CIA impact and unscoped (S:U) reach is consistent with remote code execution in the process context of the Coherence node.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 branches - Oracle does not publish standalone version numbers in the CVE record, so consult the CPU matrix for the exact patch/bundle level for your installation and apply it as the primary fix. Until patched, reduce exposure by restricting network access to Coherence cluster, proxy, and management listener ports so they are reachable only from trusted application tiers (firewall/segmentation), which limits the unauthenticated TCP attack surface but can break inter-node clustering if applied too broadly. Where Coherence*Extend/proxy services are not required, disable or bind them to internal interfaces only, accepting that remote client extend connectivity will be lost. If the deployment supports it, enable TLS and authentication/authorization on cluster and proxy communication to raise the bar against untrusted TCP clients.