What is the CVSS score of CVE-2026-60221?

CVE-2026-60221 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60221?

Oracle Coherence Core, a foundational component within Fusion Middleware versions 12.2.1.4.0 through 15.1.1.0.0, is vulnerable to unauthenticated remote complete system takeover affecting…

How to fix or mitigate CVE-2026-60221?

Within 24 hours, identify and catalog all Oracle Coherence Core instances running affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) and assess criticality of each system; implement immediate network segmentation to restrict TCP access to Coherence ports to authorized internal hosts only and disable external network connectivity where operationally feasible. Within 7 days, establish enhanced logging and behavioral monitoring on all affected Coherence systems, implement authentication controls at adjacent network layers (WAF, API gateways, network appliances), document all compensating controls in incident runbooks, and communicate patch dependency to dependent application teams. Within 30 days, maintain vigilant monitoring of Oracle Security Advisories for patch release, conduct threat modeling to identify downstream systems dependent on affected Coherence instances, develop and test upgrade procedures to patched versions, and report patch status and timeline to executive stakeholders and compliance teams.

Oracle Coherence CVE-2026-60221

EUVD-2026-46627 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-w9cm-5vfv-2xr6

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes unauthenticated, easily exploitable network TCP access (AV:N/AC:L/PR:N/UI:N) resulting in full takeover, so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:53 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Coherence is possible by an unauthenticated remote attacker over TCP, affecting the Core component in Fusion Middleware versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates this 'easily exploitable' with a CVSS 3.1 base score of 9.8 and full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a high-priority patch item.

Technical ContextAI

Oracle Coherence is a Java-based in-memory data grid and distributed caching platform used within Oracle Fusion Middleware for clustering, session replication, and low-latency data access across application tiers. The affected 'Core' component handles cluster membership, inter-node communication, and object serialization/deserialization over TCP, which is the historically common attack surface for Coherence flaws (untrusted deserialization leading to remote code execution and full node compromise). Oracle did not assign a CWE (CWE: N/A) and the advisory tags label this 'Information Disclosure,' but the description explicitly states 'takeover,' indicating impact well beyond disclosure - the tag likely reflects a coarse classification rather than the true worst-case impact. The single CPE provided, cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:*, is version-wildcarded and does not by itself delimit the affected range.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 as the primary remediation; consult https://www.oracle.com/security-alerts/cpujul2026.html and apply the corresponding CPU patch for your exact Coherence version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0), as Oracle does not publish standalone semantic fix versions here - the patch is identified by the CPU rather than a discrete version string, so no independent fix-version number is asserted. Until patched, restrict network exposure of Coherence cluster and management TCP ports (for example the Coherence Extend/TCMP ports and any management endpoints) to trusted hosts only via firewall/security-group ACLs, and place Coherence nodes on an isolated cluster network segment; the trade-off is that overly tight ACLs can break legitimate cluster membership or Extend client connectivity, so validate against your topology. Where supported, enforce TLS/SSL and authentication on Coherence Extend and cluster communication to reduce the unauthenticated attack surface, accepting the configuration and performance overhead this introduces.