What is the CVSS score of CVE-2026-60229?

CVE-2026-60229 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60229?

Oracle Coherence, a critical in-memory data grid component used in Oracle Fusion Middleware deployments, can be completely compromised by unauthenticated remote attackers via TCP network access…

How to fix or mitigate CVE-2026-60229?

Within 24 hours: Inventory all systems running Oracle Coherence and Oracle Fusion Middleware, document network connectivity and data criticality, and immediately restrict TCP network access to Coherence components through firewall rules or network segmentation to limit exposure to trusted systems only. Within 7 days: Contact Oracle Support for patch timeline and interim guidance, escalate to your account team given the CRITICAL rating, implement network-level monitoring to detect exploitation attempts against Coherence ports, and document all compensating controls in your risk register. Within 30 days: Apply the vendor-released patch to all Coherence instances immediately upon availability from Oracle, validate patch installation against configurations in your inventory, and conduct forensic review of Coherence access logs from the vulnerability disclosure date forward to confirm no unauthorized access occurred.

Oracle Coherence CVE-2026-60229

EUVD-2026-46644 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-wmm7-2925-jr64

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated network TCP exploitation that is easily exploitable and yields full takeover, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:50 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware allows an unauthenticated attacker with only TCP network access to fully compromise the in-memory data grid, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the combination of no authentication and full-system takeover makes it a top-priority patch.

Technical ContextAI

Oracle Coherence is a Java-based distributed in-memory data grid and caching platform used to scale and cluster stateful application data across Fusion Middleware and WebLogic-based deployments. The flaw resides in the 'Core' component, which handles cluster membership and inter-node communication over Coherence's TCP-based cluster/proxy protocols (Coherence*Extend / TCMP). Oracle did not assign a CWE (CWE: N/A), but historically Coherence takeover flaws in this class stem from unsafe deserialization of untrusted objects received over the cluster/extend TCP listener, which lets a remote peer drive Java object instantiation and gadget-chain execution. The CPE 'cpe:2.3:a:oracle_corporation:oracle_coherence' confirms this is the standalone Coherence product rather than a bundled component.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for each affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); an exact fixed build number was not included in this input, so obtain the precise patch/bundle-patch identifier from that advisory and MOS. Because the vector is unauthenticated network TCP, the highest-value compensating control until patching is network isolation: restrict the Coherence cluster (TCMP) and Coherence*Extend proxy listener ports to trusted management subnets via firewall/ACLs and ensure no Coherence listener is internet-exposed (side effect: cross-datacenter or client-tier connectivity may break if segmentation is too tight). Where supported, enable Coherence security features such as TLS/SSL on cluster and Extend connections and identity/host-based access control to authenticate peers (side effect: configuration and certificate management overhead), and if the class involves deserialization, enforce POF/serialization allowlists rather than default Java serialization. These are stopgaps only - the Oracle CPU patch is the definitive fix.