What is the CVSS score of CVE-2026-60218?

CVE-2026-60218 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Coherence are affected by CVE-2026-60218?

Critical vulnerability in Oracle Coherence (versions 12.2.1.4.0-15.1.1.0.0) enables complete remote system compromise, exposing organizations to data theft, application failure, and operational…

How to fix or mitigate CVE-2026-60218?

Within 24 hours, identify all Oracle Coherence deployments using versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 in your environment. Within 7 days, apply the Oracle July 2026 Critical Patch Update to all affected Coherence cluster members; for systems unable to patch immediately, implement network access controls restricting connectivity to Coherence clusters to trusted internal subnets. Within 30 days, complete patching across all affected systems and verify successful deployment through system confirmation.

Oracle Coherence CVE-2026-60218

EUVD-2026-46624 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-2v72-mg9p-jmxc

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable TCP service (AV:N), Oracle-confirmed easy exploitation (AC:L), requires low-privilege foothold not anonymous access (PR:L), no user interaction, and full takeover yields C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:54 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence is possible over the network in this Oracle Fusion Middleware Core-component flaw affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low-privileged attacker with TCP network access to a Coherence cluster member can leverage it to fully compromise confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis, and the fix ships in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Coherence is an in-memory distributed data grid used within Oracle Fusion Middleware to provide clustered caching, session replication, and low-latency shared state for Java/WebLogic applications. Cluster members communicate over TCP (and TCMP), so the exposed attack surface is the inter-member and client connection layer of the Core component. Oracle did not assign a CWE (N/A) and provides no root-cause class detail; historically, Coherence 'takeover' issues of this shape stem from insecure deserialization of data exchanged between cluster members or clients, but that root cause cannot be confirmed from the supplied data. The CPE cpe:2.3:a:oracle_corporation:oracle_coherence identifies the affected product but is not version-pinned in the feed.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for your specific Coherence branch - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0; consult that advisory for the exact patch/bundle numbers, which were not included in this feed. Until patching is complete, restrict network access to Coherence cluster ports (TCMP/TCP and any exposed Coherence*Extend proxy listeners) so only trusted cluster members and application tiers can reach them, and segregate the grid onto an isolated management network - the trade-off is that misconfigured firewall rules can break cluster formation or client connectivity. Where Coherence*Extend is exposed to less-trusted clients, disable or firewall those proxy endpoints and enforce authentication/TLS on cluster communication; note this can add latency and requires certificate management. Because exploitation needs only low privileges, also review and tighten credentials and accounts that can reach the grid.