What is the CVSS score of CVE-2026-60232?

CVE-2026-60232 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60232?

Oracle Coherence, a core distributed caching component in Oracle Fusion Middleware, suffers from a critical vulnerability allowing unauthenticated attackers to achieve complete remote system takeover…

How to fix or mitigate CVE-2026-60232?

Within 24 hours, identify and inventory all Oracle Coherence instances running versions 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0, noting which are internet-facing or accessible from untrusted networks. Within 7 days, implement network segmentation to restrict HTTP access to Coherence instances and deploy Web Application Firewall (WAF) rules to block suspicious HTTP traffic patterns; also audit and disable unnecessary Coherence network listeners. Within 30 days, contact your Oracle account team regarding patch timelines, monitor Oracle security advisories weekly, and establish a prioritized upgrade plan for all affected systems targeting completion within 60-90 days.

Oracle Coherence CVE-2026-60232

EUVD-2026-46647 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-9h8h-g8x2-68j9

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated, easily exploitable HTTP access yielding full takeover, supporting AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:49 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) can be achieved by unauthenticated remote attackers sending crafted HTTP traffic, affecting versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates this CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable,' meaning no authentication, user interaction, or special preconditions are required. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform embedded within many Oracle Fusion Middleware and WebLogic-based deployments, used for clustering, session replication, and low-latency data access across application tiers. The flaw resides in the Core component and is reachable over HTTP, consistent with Coherence's management/extend proxy and REST-style interfaces that can be exposed on network-facing ports. No CWE was assigned in the source data, so the exact root-cause class (e.g., deserialization, authentication bypass, or injection) cannot be confirmed; however, Oracle's own tagging includes 'Information Disclosure,' while the description states the outcome is full product takeover, indicating a weakness that escalates beyond mere data exposure to complete control. The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:*.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; consult the CPU patch matrix for the exact patched build corresponding to your 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 installation, as Oracle distributes these as CPU patch bundles rather than a single named release version. Until patching is complete, reduce exposure by restricting network access to Coherence Extend proxy and management/HTTP listener ports so they are reachable only from trusted application-tier hosts, placing Coherence clusters on isolated management VLANs behind firewalls, and disabling any internet- or DMZ-facing HTTP endpoints that are not operationally required; note these network controls can disrupt legitimate cross-tier clustering or client Extend connectivity and must be validated against your topology. Enforcing authentication/TLS on Coherence Extend and management interfaces further limits reachability but does not substitute for the vendor patch.