What is the CVSS score of CVE-2026-60222?

CVE-2026-60222 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60222?

A high-severity remote code execution vulnerability in Oracle Coherence (Oracle Fusion Middleware Core) permits complete system takeover by unauthenticated network attackers, affecting supported…

How to fix or mitigate CVE-2026-60222?

Within 24 hours, identify and inventory all systems running Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0, documenting network exposure and business criticality. Within 7 days, implement network segmentation to restrict access to T3 and IIOP listener ports from untrusted networks, and deploy detection signatures for exploitation attempts. Within 30 days, evaluate and execute upgrade paths to unaffected Oracle Coherence versions or alternative solutions, prioritizing internet-facing and production systems.

Oracle Coherence CVE-2026-60222

EUVD-2026-46628 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-xr6j-7932-jh57

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network reach over T3/IIOP (AV:N/PR:N/UI:N) with vendor-noted difficulty (AC:H) and full takeover justifying C:H/I:H/A:H, scope unchanged within the JVM.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:53 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is possible when an unauthenticated attacker reaches an exposed T3 or IIOP listener over the network, affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this CVSS 3.1 8.1 with full confidentiality, integrity and availability impact but flags it as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but severe if a working exploit emerges.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid and caching platform bundled with Oracle Fusion Middleware and commonly co-deployed with Oracle WebLogic Server. The named attack surface is the T3 protocol (WebLogic's proprietary RMI-style wire protocol) and IIOP (CORBA over the Internet Inter-ORB Protocol) - both Java remoting channels historically abused through unsafe Java object deserialization, the same class of flaw behind many prior WebLogic/Coherence RCE advisories. No CWE was assigned by Oracle, but the T3/IIOP vector combined with full CIA impact and 'takeover' language is consistent with a deserialization-driven remote code execution weakness (CWE-502 class) in the Core component. The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence, and impact scope is Unchanged (S:U), meaning the compromise stays within the Coherence/JVM security authority rather than pivoting to a separate system automatically.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026; consult https://www.oracle.com/security-alerts/cpujul2026.html to identify the specific patch bundle for your Coherence version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0), as no single fixed version string was published in the source data beyond the CPU reference. Until patched, reduce exposure by ensuring T3 and IIOP listeners are not reachable from untrusted networks: use WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) or network ACLs to restrict T3/T3S to known cluster and management hosts, and disable IIOP if it is not required (trade-off: breaks any CORBA/EJB clients that rely on it). Firewall the Coherence/WebLogic ports so they are internal-only, and place management interfaces behind a VPN or bastion. These controls limit reachability but do not remove the underlying flaw, so treat them as interim measures pending the CPU patch.