What is the CVSS score of CVE-2026-60234?

CVE-2026-60234 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60234?

Oracle Coherence in Fusion Middleware deployments face critical remote takeover risk via unauthenticated network access, jeopardizing confidential business data stored in the in-memory grid.

How to fix or mitigate CVE-2026-60234?

Within 24 hours, conduct an inventory of all systems running Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and immediately restrict TCP network access to these systems using firewall rules and network ACLs, limiting connections to approved internal networks and administrative systems only. Within 7 days, implement additional compensating controls such as VPN tunneling for Coherence access, deploy network intrusion detection signatures targeting CVE-2026-60234 exploitation attempts, and contact Oracle support to obtain mitigation guidance and expected patch timeline. Within 30 days, establish a monitoring plan for Oracle's security communications; once a patch is released, coordinate with your change management process to schedule and execute the upgrade to the patched version across all affected Coherence instances.

Oracle Coherence CVE-2026-60234

EUVD-2026-46649 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-59x7-xrgv-rcxv

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated, easily exploitable TCP network attack yielding full product takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:49 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (a component of Oracle Fusion Middleware) allows an unauthenticated attacker with TCP network access to fully compromise the affected in-memory data grid, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects complete loss of confidentiality, integrity, and availability with no authentication or user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable' framing and full-impact vector make this a high-priority patch across affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid and caching platform used within Oracle Fusion Middleware to provide scalable, low-latency clustered data storage for enterprise Java applications (e.g., WebLogic-backed deployments). Cluster nodes and clients communicate over TCP (Coherence*Extend / cluster proxy services), and the flaw resides in the Core component reachable over the network. Oracle assigned no CWE, but the combination of an unauthenticated network vector leading to full product takeover is characteristic of unsafe deserialization of untrusted data or a similar remote object-processing weakness commonly seen in Java middleware components - this classification is inferred from the impact profile, not confirmed by Oracle. Vendor tags label it as Information Disclosure, though the full C/I/A impact indicates the consequence extends well beyond disclosure.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for your specific Coherence release line (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); Oracle ships these as CPU patches rather than a single named build, so consult the CPU advisory's patch availability table for the exact patch number matching your version - this is a Patch available per vendor advisory, and no independent exact fix-build string is provided in the input to cite here. Until patching, restrict network reachability to Coherence cluster and Coherence*Extend proxy TCP ports so they are accessible only from trusted application-tier hosts via firewall/security-group rules or network segmentation, which reduces exposure but can break legitimate remote clients if scoped too broadly; where Coherence*Extend proxy access is not required, disable or bind proxy services to internal interfaces only. Verify no Coherence ports are exposed to untrusted or internet-facing networks as an immediate compensating control.