What is the CVSS score of CVE-2026-60214?

CVE-2026-60214 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle Coherence are affected by CVE-2026-60214?

Oracle Coherence, a critical in-memory data caching component of Oracle Fusion Middleware, contains a high-severity authentication bypass vulnerability (CVE-2026-60214) that allows network-adjacent…

How to fix or mitigate CVE-2026-60214?

Within 24 hours, identify all systems running Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and assess exposure to adjacent networks. Within 7 days, apply the Oracle July 2026 Critical Patch Update to all vulnerable instances, prioritizing production systems and those processing sensitive data. By day 30, validate patching completion through inventory verification, conduct functionality testing of Coherence clusters and dependent applications, and ensure no vulnerable versions remain in any environment.

Oracle Coherence CVE-2026-60214

EUVD-2026-46620 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-m8x3-8fq4-24rx

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

8.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.7 HIGH

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Attack is confined to the local cluster segment (AV:A) and needs a low-privilege foothold (PR:L); it grants full read/modify of grid data with cluster scope change (S:C, C:H/I:H) but no availability loss (A:N).

3.1 AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:56 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.7

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Coherence executes to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Coherence accessible data as well as unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Adjacent-network compromise of Oracle Coherence (Oracle Fusion Middleware Core component) allows a low-privileged attacker on the same physical communication segment to read and modify all Coherence-accessible data, with a scope change that can significantly impact other products on the host. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, carrying a CVSS 3.1 base score of 8.7 (High) with high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis; the flaw is tagged as an authentication bypass and is fixed in the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle Coherence is an in-memory distributed data grid used to cache and share application state across clustered JVMs in Oracle Fusion Middleware and WebLogic-based deployments. Cluster members discover and coordinate over a cluster communication protocol (TCMP) on the local network segment, which is why the CVSS vector is AV:A (adjacent). The 'Authentication Bypass' tag and the low-privilege requirement suggest that cluster-level authentication or trust controls on this inter-node channel can be circumvented, letting an attacker on the same segment interact with the grid as a trusted participant. Oracle does not assign a CWE for this entry, so the precise weakness class is not formally classified, but the behavior is consistent with improper authentication/trust validation on the cluster protocol.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Coherence versions; the CPU is the authoritative source for exact patch/interim-patch numbers per version and should be consulted directly since Oracle does not publish standalone fix version strings. Because the attack is constrained to AV:A (adjacent), the strongest compensating control until patching is network isolation: place Coherence cluster (TCMP) traffic on a dedicated, isolated VLAN or well-known-address (WKA) unicast configuration with firewall rules restricting cluster ports to only legitimate node IPs, which prevents rogue participants on the shared segment from joining - the trade-off is added network configuration and the need to enumerate all legitimate cluster members. Additionally enable Coherence security features such as cluster member identity/TLS on the cluster socket where supported to harden the inter-node channel; the side effect is added handshake overhead and configuration complexity across all nodes.