What is the CVSS score of CVE-2026-60211?

CVE-2026-60211 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Coherence are affected by CVE-2026-60211?

Oracle Coherence, a core component of Fusion Middleware deployments, is vulnerable to complete unauthenticated takeover affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

How to fix or mitigate CVE-2026-60211?

Within 24 hours, conduct an inventory of all Oracle Coherence deployments and determine which systems run vulnerable versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); assess network topology to identify which Coherence instances are reachable from untrusted network segments. Within 7 days, implement network segmentation to isolate Coherence systems to authorized hosts only, restrict inter-cluster communication through firewall policies, enable enhanced logging and monitoring on all Coherence nodes, and contact Oracle support to confirm patch availability timeline. Within 30 days, establish an upgrade plan to patched versions upon Oracle release, test patches in staging environments, prioritize remediation of production Fusion Middleware systems, and maintain compensating controls (network isolation, encryption, anomaly monitoring) until patches are deployed.

Oracle Coherence CVE-2026-60211

EUVD-2026-46617 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-4g25-xq6q-97c2

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Adjacent-only cluster-network access (AV:A), no auth or interaction and low complexity per Oracle, with described full takeover mapping to C:H/I:H/A:H and unchanged scope.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:57 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Coherence executes to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence (Core component) is possible by an unauthenticated attacker positioned on the same physical communication segment as the server, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 8.8 with high impact to confidentiality, integrity and availability, and affects Fusion Middleware deployments running Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

Oracle Coherence is an in-memory data grid / distributed caching platform embedded in Oracle Fusion Middleware, used to cluster application-tier nodes that share state. Cluster members discover and communicate with each other over Coherence's own cluster protocol (TCMP, typically UDP/TCP on the cluster network), which is why the CVSS vector specifies AV:A (Adjacent) - an attacker must reach the layer-2/physical segment carrying inter-node cluster traffic. The advisory places the flaw in the 'Core' component and describes a full compromise, consistent with abuse of the trusted cluster-membership/communication channel rather than an authenticated management API. No CWE was assigned by the source, so the precise weakness class (e.g. deserialization, authentication bypass, or trust of unauthenticated cluster join) cannot be confirmed from the provided data; the vendor tag 'Information Disclosure' is present but understates the described total-takeover impact.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update for the affected Coherence release train (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0) as documented at https://www.oracle.com/security-alerts/cpujul2026.html; no exact patched build number is enumerated in the provided data, so treat this as 'patch available per vendor advisory' and pull the specific patch ID for your version from the CPU. Because the attack requires presence on the Coherence cluster communication segment, the highest-value compensating control until patching is network isolation: place Coherence cluster (TCMP) traffic on a dedicated, access-controlled VLAN or private interface, restrict cluster ports to known member IPs, and enable Coherence's built-in security features (authorized-hosts filtering and TLS/SSL for cluster and Extend traffic) - the trade-off is added configuration and potential latency/handshake overhead on inter-node communication. Avoid running Coherence cluster traffic on shared or user-accessible LAN segments.