What is the CVSS score of CVE-2026-60225?

CVE-2026-60225 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60225?

Oracle Coherence, a critical data caching component in Oracle Fusion Middleware, is vulnerable to complete remote system takeover (CVE-2026-60225, CVSS 9.8) by unauthenticated attackers.

How to fix or mitigate CVE-2026-60225?

Within 24 hours, inventory all Oracle Coherence deployments (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0), identify which are exposed to networks beyond your direct control, and document criticality and dependencies. Within 7 days, contact Oracle Support to confirm patch status and timelines, implement network segmentation to isolate Coherence clusters from untrusted sources, and restrict access to default Coherence ports (TCP 8088, 8089) via firewall rules. Within 30 days, validate all access control changes, implement continuous monitoring for exploitation attempts, and establish a plan with Oracle for applying patches as soon as they become available.

Oracle Coherence CVE-2026-60225

EUVD-2026-46631 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-7gf5-m76c-62w5

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes unauthenticated, easily exploitable HTTP-reachable takeover, so AV:N/AC:L/PR:N/UI:N with full C/I/A impact; scope unchanged as compromise stays within Coherence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:52 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) is achievable by unauthenticated remote attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle explicitly rates it 'easily exploitable' against supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of no authentication, low complexity, and complete-takeover impact makes it a top-priority patch.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform bundled with Oracle Fusion Middleware and used to scale stateful applications (WebLogic clusters, session state, caching tiers). The affected 'Core' component handles cluster membership, data distribution, and inter-node/service communication, and the vulnerability is reachable via HTTP, implying an exposed management or service endpoint. Oracle did not assign a CWE (CWE: N/A) and did not publish root-cause detail; however, historically Coherence takeover flaws in this class stem from unsafe deserialization of untrusted objects received over the network, which would align with an unauthenticated HTTP vector yielding full code execution. The single CPE string (cpe:2.3:a:oracle_corporation:oracle_coherence) confirms the product but is unversioned, so the affected version list comes from the Oracle advisory text rather than the CPE. Note the input tags this as 'Information Disclosure,' which conflicts with the description's 'takeover' and the C:H/I:H/A:H vector - the vector should be treated as authoritative.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to all affected Coherence installs (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); this is characterized as Patch available per vendor advisory, as Oracle CPUs deliver cumulative patch bundles rather than a single named point release, and the exact patched build should be taken from the CPU patch matrix for your version. Until patched, reduce exposure by ensuring Coherence Core and any HTTP/management endpoints are not reachable from untrusted networks - bind them to internal cluster interfaces and use network segmentation or firewall rules to restrict access to known cluster members and administrative hosts only (trade-off: mis-scoped rules can break cluster membership or legitimate client access, so validate node-to-node connectivity after changes). If Coherence is fronted by WebLogic or a load balancer, restrict or block external access to the Coherence service path. These are compensating controls only; the CPU patch is the sole confirmed remediation.