What is the CVSS score of CVE-2026-60219?

CVE-2026-60219 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60219?

Oracle Coherence, a core component of Oracle Fusion Middleware, contains a critical remote vulnerability (CVE-2026-60219, CVSS 9.8) enabling unauthenticated network attackers to achieve complete…

How to fix or mitigate CVE-2026-60219?

Within 24 hours: Inventory all Oracle Coherence instances across environments, document affected versions (14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0), and identify instances exposed to untrusted networks. Within 7 days: Deploy Oracle's July 2026 Critical Patch Update to all affected versions in development and test environments first, validate patch compatibility with existing configurations and dependent applications, and schedule production deployment windows. Within 30 days: Complete patching of all production Oracle Coherence instances, verify normal operations post-patch through functional testing, and implement network segmentation to restrict Coherence access to trusted internal systems only.

Oracle Coherence CVE-2026-60219

EUVD-2026-46625 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-fgcr-f77f-8q95

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor confirms unauthenticated, easily exploitable network TCP attack yielding full takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:54 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated network attacker to fully compromise affected versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 over TCP. Oracle rates the flaw CVSS 9.8 with full confidentiality, integrity, and availability impact and describes it as "easily exploitable," meaning no authentication, user interaction, or special access is required. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV; remediation is delivered through the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid and caching platform bundled with Oracle Fusion Middleware, used to scale stateful Java applications across clustered nodes that communicate over TCP (and Coherence*Extend/Tangosol Cluster Management Protocol). The affected 'Core' component handles cluster membership and data serialization, and Coherence historically exposes network-facing services that deserialize objects from cluster or proxy traffic - a class of issue frequently rooted in unsafe deserialization of untrusted data (CWE-502), though NVD lists no specific CWE for this CVE. The single CPE provided (cpe:2.3:a:oracle_corporation:oracle_coherence) is version-wildcarded, so precise affected ranges must be taken from Oracle's advisory text (14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) rather than the CPE. The Oracle-supplied tag 'Information Disclosure' understates the impact, since the CVSS vector and description both indicate full system takeover rather than mere data exposure.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html); Oracle's CPU model ships the fix as cumulative patches for each affected release train (14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) rather than as a single tagged version, so identify and deploy the specific patch matching your installed version and stack. Because the vector is unauthenticated over TCP, prioritize network-level compensating controls until patching completes: restrict Coherence cluster ports and any Coherence*Extend/proxy listener ports to trusted management subnets via firewall/security-group rules (this can break legitimate cross-node or client-extend traffic if not scoped carefully), place Coherence nodes on an isolated back-end VLAN with no direct internet or general LAN exposure, and enable Coherence's authentication/TLS transport features on proxy and cluster communication where supported (adds latency and configuration overhead but blocks anonymous TCP access). Avoid exposing any Coherence service directly to untrusted networks. Because no patch version string is given in the input, do not assume a version number - confirm the exact patch identifier in the CPU advisory before deployment.