What is the CVSS score of CVE-2026-60217?

CVE-2026-60217 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60217?

Oracle Coherence versions 12.2.1.4.0 through 15.1.1.0.0 can be completely compromised by any unauthenticated attacker with network access, enabling data theft and system takeover with a CVSS 10.0…

How to fix or mitigate CVE-2026-60217?

Within 24 hours, conduct immediate inventory of all systems running Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and implement firewall rules blocking all inbound access to Coherence default ports (TCP 9099, 7574) from untrusted networks. Within 7 days, deploy network segmentation isolating Coherence clusters from sensitive applications and databases, enable comprehensive connection logging, and establish 24/7 SOC monitoring with detection rules for exploitation attempts. Within 30 days, contact Oracle to confirm patch release timelines, develop an upgrade plan targeting patched versions, and if upgrades are unfeasible, ensure persistent compensating controls remain in place while preparing incident response procedures for potential breach scenarios.

Oracle Coherence CVE-2026-60217

EUVD-2026-46623 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-244c-7qjj-mm93

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

10.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Unauthenticated low-complexity network TCP access with no user interaction yields full takeover plus cross-product impact, so PR:N, AC:L, S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:55 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 10.0

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core component of this Oracle Fusion Middleware in-memory data grid affected in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The maximum-severity CVSS 10.0 rating reflects a scope-changing flaw whose exploitation can pivot beyond Coherence to impact other co-deployed products. There is no public exploit identified at time of analysis, but the trivial exploitability and unauthenticated network reach make this a top-priority patch.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid and caching platform used inside Oracle Fusion Middleware and frequently co-deployed with Oracle WebLogic Server for clustered, low-latency data management. The flaw resides in the product Core and is reachable over TCP, consistent with Coherence's cluster and proxy service listeners that accept remote connections. Oracle assigned no CWE, but the unauthenticated remote takeover profile with scope change is characteristic of unsafe deserialization of untrusted objects on a network-exposed Java service, a recurring root-cause class in Oracle middleware; this class attribution is inferred, not confirmed, given the absent CWE. The single CPE cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:* confirms Oracle Coherence itself as the affected product.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (patch available per vendor advisory) as documented at https://www.oracle.com/security-alerts/cpujul2026.html, which covers all affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; map your installed release to its corresponding CPU patch since Oracle does not publish a single fixed-version string in the input. Until patching completes, restrict the Coherence cluster and proxy listener TCP ports with network segmentation and firewall allowlists so only trusted cluster members and application tiers can reach them (trade-off: an overly tight or misconfigured allowlist can break clustering or client connectivity), and ensure no Coherence TCP service is exposed to untrusted or internet-facing networks. Because the input identifies no vendor-sanctioned feature-level workaround, this network isolation is a compensating control, not a replacement for the CPU patch.