What is the CVSS score of CVE-2026-60216?

CVE-2026-60216 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60216?

Oracle Coherence, a critical enterprise component used for distributed data caching, is subject to unauthenticated remote takeover via network access.

How to fix or mitigate CVE-2026-60216?

Within 24 hours: Conduct urgent inventory of all Oracle Coherence deployments and determine which systems are exposed to untrusted networks; document dependency mappings and criticality. Within 7 days: Implement strict network-level access controls restricting Coherence TCP ports to verified internal sources; enable comprehensive audit logging and configure alerts for suspicious connection patterns. Within 30 days: Deploy vendor patch immediately upon availability; if delay is unacceptable, evaluate version upgrades to patched releases or migration of critical services to alternative technologies.

Oracle Coherence CVE-2026-60216

EUVD-2026-46622 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-qjvh-6ggw-xpw5

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easily exploitable unauthenticated TCP-network takeover with full CIA loss, giving AV:N/AC:L/PR:N/UI:N and C/I/A:H; scope unchanged as impact stays within Coherence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:55 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Coherence (Core component) allows an unauthenticated attacker with TCP network access to take over affected installations, per Oracle's July 2026 Critical Patch Update. Oracle rates this CVSS 9.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' affecting Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector combined with 'takeover' impact makes this a top-priority patch.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid and caching platform bundled with Oracle Fusion Middleware, used to scale application state across clustered JVMs via its own TCP-based cluster and proxy (Coherence*Extend/TCMP) protocols. The flaw resides in the Core component and is reachable over TCP without authentication. Oracle did not assign a CWE (CWE: N/A), but 'takeover' via an unauthenticated network protocol in a Java data-grid product is characteristically consistent with unsafe deserialization of untrusted data or a protocol-level injection in the cluster/proxy listener - a common root-cause class in Java middleware. The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence, spanning multiple supported release trains.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory; Oracle CPUs ship cumulative patches per affected version 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - apply the CPU patch corresponding to your installed release). Until patching is complete, restrict network exposure of Coherence cluster and proxy (Coherence*Extend) TCP listener ports to trusted management segments only via firewall/security-group rules and disable any Internet or untrusted-network exposure of these ports; where Coherence*Extend proxy access is not required, disable the proxy service, and enable TLS/SSL and authorized-host filtering on cluster and extend listeners. The trade-off is that tightening host filtering or disabling proxy services can break legitimate remote clients and cluster members, so validate connectivity for authorized nodes before enforcing.