What is the CVSS score of CVE-2026-60230?

CVE-2026-60230 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60230?

Oracle Coherence (Oracle Fusion Middleware) contains a critical remote unauthenticated vulnerability (CVE-2026-60230, CVSS 9.8) enabling complete system compromise across affected versions 12.2.1.4.0…

How to fix or mitigate CVE-2026-60230?

Within 24 hours: Inventory all systems running Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and assess their network exposure. Within 7 days: Implement network segmentation to restrict TCP access to Coherence instances to authorized internal networks only, disable unnecessary external connectivity, and deploy targeted monitoring and alerting for exploitation attempts. Within 30 days: Establish a task force to monitor Oracle's Critical Patch Update advisories for CVE-2026-60230 remediation; upon patch availability, prioritize immediate deployment across all affected instances with minimal delay, scheduling a phased rollout if needed to maintain business continuity.

Oracle Coherence CVE-2026-60230

EUVD-2026-46645 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-54f2-49jv-vh8q

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easily exploitable, unauthenticated network TCP access yielding full takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H; scope unchanged as compromise stays within the Coherence process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:50 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote unauthenticated compromise of Oracle Coherence (a component of Oracle Fusion Middleware) allows attackers with only network TCP access to fully take over the affected instance, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 and affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit identified at time of analysis, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) and full confidentiality, integrity, and availability impact make this a high-priority patch item.

Technical ContextAI

Oracle Coherence is Oracle's in-memory data grid (IMDG) and distributed caching/clustering platform used to scale stateful Java applications, commonly deployed alongside Oracle WebLogic Server within Fusion Middleware. The vulnerable 'Core' component handles clustering and inter-node communication over TCP, which is the exposed attack surface here. Oracle does not assign a CWE (listed as N/A), but network-reachable takeover flaws in Coherence historically stem from unsafe deserialization of untrusted objects received over the cluster/proxy protocol - a class consistent with CWE-502 - though this root cause is inferred, not confirmed by Oracle.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle publishes exact patch numbers per product version in the CPU matrix, and administrators should apply the CPU corresponding to their installed release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0). Because Oracle CPUs are cumulative, the latest CPU supersedes prior fixes. If patching cannot be done immediately, the primary compensating control is network isolation: restrict TCP access to Coherence cluster and proxy/extend ports (commonly the cluster port and any configured Coherence*Extend proxy listener) to trusted management subnets via firewall/security-group rules, and ensure no Coherence port is exposed to the internet or untrusted VLANs - the trade-off is that legitimate remote Extend clients must be re-scoped or tunneled. Where deserialization is the suspected vector, enabling and tightening Coherence serialization filters/allowlists (POF or JEP-290-style object-input filtering) reduces exposure but can break clients relying on default Java serialization and does not substitute for the vendor patch.