What is the CVSS score of CVE-2026-60213?

CVE-2026-60213 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Oracle Coherence CVE-2026-60213

EUVD-2026-46619 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-7rjm-vwj9-9j7h

Denial Of Service Oracle Oracle Coherence Oracle Corporation

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable HTTP surface with no auth required matches AV:N/PR:N; vendor-stated difficulty and absence of described trivial trigger support AC:H; no confidentiality loss, partial integrity, full availability impact confirmed.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:14 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence as well as unauthorized update, insert or delete access to some of Oracle Coherence accessible data. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H).

AnalysisAI

Denial-of-service and partial data integrity compromise in Oracle Coherence's Core component allows unauthenticated network attackers to hang or crash the service or manipulate a subset of accessible data via HTTP. Affected are three actively supported versions - 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - spanning the current Oracle Fusion Middleware release train. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the zero-confidentiality-impact, high-availability-impact profile is consistent with a resource exhaustion or malformed-request crash class of flaw that may attract opportunistic targeting of exposed Coherence cluster endpoints.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform forming a core layer of the Oracle Fusion Middleware stack, used primarily for high-availability, clustered Java EE applications. The vulnerable component is identified as 'Core' - the foundational data management and cluster-communication engine - accessible over HTTP according to the CVSS attack vector. The CPE string (cpe:2.3:a:oracle_corporation:oracle_coherence) confirms the affected artifact is the Oracle-branded Coherence product itself, not a third-party derivative. No CWE is assigned in the advisory, which prevents precise root-cause classification; however, the impact profile (complete availability loss, limited integrity, no confidentiality) combined with high attack complexity is broadly consistent with improper input validation, a race condition, or a resource management flaw in request processing. Oracle's CPU July 2026 advisory (EUVD-2026-46619) is the authoritative disclosure source.

RemediationAI

Apply the patches distributed through Oracle's Critical Patch Update for July 2026, available via My Oracle Support and documented at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish exact patched sub-version strings in the public advisory; administrators should consult My Oracle Support for the specific patch ID applicable to their installed version (14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0). As a compensating control prior to patching, restrict network access to Coherence HTTP endpoints using host-based or network-layer firewall rules, allowing only trusted application-tier hosts to reach Coherence cluster ports - this directly addresses the AV:N attack vector and eliminates the unauthenticated exposure without modifying application behavior. Note that Coherence clusters often bind management and data endpoints on the same interface; blanket port blocking may affect intra-cluster replication if not scoped carefully. Monitoring for anomalous process restarts or memory pressure spikes on Coherence nodes can serve as a detective control until the patch is applied.