What is the CVSS score of CVE-2026-60228?

CVE-2026-60228 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60228?

Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0-key components of Oracle Fusion Middleware-contain a critical vulnerability (CVSS 9.8) allowing unauthenticated remote…

How to fix or mitigate CVE-2026-60228?

Within 24 hours: Identify all systems running Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and assess their network exposure. Within 7 days: Implement firewall rules and network segmentation to restrict TCP access to Coherence Core components to only essential internal systems; disable external network access where feasible; enable logging and alerting for connection attempts. Within 30 days: Monitor Oracle's Critical Patch Update channel for patch availability and contact Oracle support for guidance; test and prepare rapid deployment of patched versions once available; assess upgrade options to newer Coherence versions as an alternative.

Oracle Coherence CVE-2026-60228

EUVD-2026-46634 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-6rch-qvrf-987h

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated TCP-reachable, easily exploitable takeover with full CIA loss, so AV:N/AC:L/PR:N/UI:N and C/I/A:H; scope unchanged as impact stays within Coherence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:50 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with network access over TCP reaches the Core component, yielding full confidentiality, integrity, and availability compromise (CVSS 9.8). The flaw affects Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 shipped as part of Oracle Fusion Middleware, and is addressed in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching/clustering platform embedded in Oracle Fusion Middleware and WebLogic-based deployments, used to scale application state across clustered nodes over TCP-based cluster and proxy protocols (e.g., Coherence*Extend / TCMP). The affected 'Core' component handles cluster membership, serialization, and data distribution, which historically exposes Java-object deserialization and protocol-parsing surfaces to the network. Oracle classifies the impact as a full takeover reachable pre-authentication, and the associated tag is Information Disclosure; because the CWE is listed as N/A, the precise root-cause weakness class (e.g., unsafe deserialization, CWE-502) cannot be confirmed from the provided data and is inferred from the product's known attack surface. The CPE cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:* identifies the affected application without pinning versions in the CPE itself; the version list comes from Oracle's advisory text.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which contains the fix for the affected Coherence releases (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch bundle and version applicable to your deployment (Patch available per vendor advisory - Oracle CPUs deliver fixes as cumulative patches rather than a single named upstream release). Until patching, reduce exposure of Coherence cluster and proxy (Coherence*Extend/TCMP) TCP ports by restricting them to trusted management segments via firewall/network ACLs so unauthenticated attackers cannot reach the Core listener - with the trade-off that legitimate remote extend clients or cross-host cluster members must be explicitly allowlisted or they will lose connectivity. Where supported, enable transport authentication/TLS on Coherence*Extend and cluster communication to require identity before protocol processing, accepting added configuration and certificate-management overhead. Avoid exposing any Coherence listener to untrusted or internet-facing networks.