What is the CVSS score of CVE-2026-60235?

CVE-2026-60235 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Coherence are affected by CVE-2026-60235?

Oracle Coherence 15.1.1.0.0, a critical data infrastructure component in Fusion Middleware, faces a security vulnerability allowing external attackers to crash systems and access sensitive cached…

How to fix or mitigate CVE-2026-60235?

Within 24 hours, inventory all production and non-production systems running Oracle Coherence 15.1.1.0.0; immediately implement firewall rules restricting TCP access to Coherence ports (default 7574) to only explicitly trusted internal sources, blocking all external network access. Within 7 days, enable comprehensive logging and monitoring on all Coherence cluster nodes for connection anomalies, node failures, and unexpected shutdown events; contact Oracle Support to confirm patch release timeline and interim hardening recommendations; verify disaster recovery procedures can restore Coherence clusters within your documented RTO. Within 30 days, develop and test an upgrade plan to the patched version once Oracle releases it, document all network segmentation controls in your security baseline, and conduct business impact analysis for each Coherence-dependent application to prioritize remediation workflows.

Oracle Coherence CVE-2026-60235

EUVD-2026-46650 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-gjjm-qhf9-7gmj

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

8.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

vuln.today AI

8.6 HIGH

Unauthenticated TCP-reachable service (AV:N/AC:L/PR:N/UI:N) with complete DOS (A:H) and partial data read/modify (C:L/I:L), no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:48 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.6

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence as well as unauthorized update, insert or delete access to some of Oracle Coherence accessible data and unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).

AnalysisAI

Denial-of-service with data tampering in Oracle Coherence 15.1.1.0.0 (Fusion Middleware Core) lets an unauthenticated network attacker hang or repeatedly crash the in-memory data grid over TCP, while also gaining limited unauthorized read and write access to a subset of grid-managed data. Rated CVSS 3.1 8.6 by Oracle and described as 'easily exploitable,' the flaw requires no authentication or user interaction. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Coherence is Oracle's distributed in-memory data grid used within Fusion Middleware for caching, clustering, and low-latency data access; affected component is the Core. Cluster members and clients communicate over TCP (Coherence*Extend / TCMP), and this class of Oracle Coherence issue typically stems from processing of untrusted network traffic reaching a listening grid port. No CWE was assigned in the input, but the CVSS profile (A:H with partial C:L/I:L) and Oracle's 'complete DOS' language point to a resource-exhaustion / improper-input-handling defect in the network message processing path rather than a full memory-corruption RCE. The only CPE provided is cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:*, which does not itself pin the affected version - Oracle's text specifies 15.1.1.0.0.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); the input does not specify an exact patched build number, so Patch available per vendor advisory - obtain the precise patch for Coherence 15.1.1.0.0 from that CPU. Until patched, reduce exposure by restricting network access to Coherence TCP listener ports (Coherence*Extend proxy and TCMP cluster ports) using firewall/security-group rules so only trusted cluster members and application tiers can reach them, and place the grid behind network segmentation rather than any externally reachable interface. Where supported, enable Coherence transport security (TLS/SSL and client authentication on Extend proxies) to limit which clients can send traffic; the trade-off is added configuration and potential latency, and access-restriction controls can break clients that legitimately connect from newly-blocked network ranges, so validate cluster membership and client connectivity after changes.