What is the CVSS score of CVE-2026-60226?

CVE-2026-60226 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60226?

Oracle Coherence within Oracle Fusion Middleware is vulnerable to complete system takeover by any unauthenticated attacker with network access; no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-60226?

Within 24 hours: Identify all Oracle Fusion Middleware deployments running Coherence and immediately restrict network access to Coherence service ports via firewall rules to allow only trusted internal IP ranges. Within 7 days: Obtain and stage the Oracle July 2026 Critical Patch Update in a non-production test environment, validate successful patching, and plan production deployment windows. Within 30 days: Complete patched deployment to all production Oracle Fusion Middleware systems and verify remediation using vulnerability assessment tools.

Oracle Coherence CVE-2026-60226

EUVD-2026-46632 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-68v8-4v9m-f2c4

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor states unauthenticated, easily exploitable TCP network access yielding full takeover, so AV:N/AC:L/PR:N/UI:N with C/I/A all High and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:51 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) is achievable by unauthenticated attackers with only TCP network reachability to the affected service. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) and Oracle's own 'easily exploitable' rating, an attacker needs no credentials or user interaction to gain complete control over confidentiality, integrity, and availability (9.8). At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, so exploitation is not confirmed; the fix ships in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

Oracle Coherence is an in-memory data grid / distributed caching and clustering platform bundled with Oracle Fusion Middleware and WebLogic Server, used for scaling stateful Java applications. Coherence cluster members communicate over TCP (and TMB/TCMP transports) on cluster and proxy/Extend ports, which is the network attack surface implied by the 'network access via TCP' language. No CWE was assigned by the source (CWE: N/A), so the precise root-cause class is unstated; the 'takeover' outcome combined with the Java-serialization-heavy history of Coherence Extend/cluster protocols is consistent with a deserialization or protocol-handling flaw, but this is inferred, not confirmed, from the available data. The single CPE (cpe:2.3:a:oracle_corporation:oracle_coherence) confirms the affected component is the Coherence product itself rather than a downstream dependency.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026 for Oracle Coherence across all affected trains (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); the exact patched build numbers are enumerated in the CPU advisory at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory - apply the CPU-designated patch for your version, as Oracle does not publish standalone tagged fix versions in the CVE text). Because Coherence patches are only released via the quarterly CPU and no interim fix is offered, prioritize patching internet-adjacent and shared-tenant clusters first. As compensating controls until patched, restrict TCP access to Coherence cluster (TCMP) and Coherence*Extend proxy ports to only trusted application hosts via firewall/security-group rules and network segmentation - this blocks the untrusted network path but will break Extend clients or cluster members that legitimately connect from outside the allowed set, so validate your client topology first. Where Coherence*Extend is not required, disable the Extend proxy service to shrink the exposed TCP surface; if serialization filtering is available in your Java/Coherence version, enable strict allow-list deserialization filters, accepting the operational risk of blocking legitimate payloads that are not on the list.