What is the CVSS score of CVE-2026-60236?

CVE-2026-60236 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60236?

Oracle Coherence (an in-memory data grid within Oracle Fusion Middleware) is subject to a critical remote takeover vulnerability affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0…

How to fix or mitigate CVE-2026-60236?

Within 24 hours: conduct a complete inventory of Coherence deployments by version across the organization, isolate affected instances to restricted network segments with minimal external connectivity, and alert senior leadership to the critical unpatched vulnerability status. Within 7 days: implement compensating controls including strict network segmentation to restrict access to Coherence ports (typically TCP 7574), enable comprehensive logging and alerting on network access attempts, evaluate whether Coherence can be disabled to reduce exposure if business operations permit, and engage procurement to prepare for immediate patch deployment upon Oracle's release. Within 30 days: apply the vendor-released patch to all affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0), conduct full application testing to validate patch deployment, and maintain enhanced monitoring throughout the remediation period.

Oracle Coherence CVE-2026-60236

EUVD-2026-46651 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-779g-5w22-fhgf

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated TCP network access with easy exploitation and full takeover, giving AV:N/AC:L/PR:N/UI:N and complete C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:48 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence (an in-memory data grid within Oracle Fusion Middleware) is achievable by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch item.

Technical ContextAI

Oracle Coherence is a distributed, in-memory data grid and caching platform bundled with Oracle Fusion Middleware, commonly used to scale stateful Java/WebLogic applications by clustering data across nodes over TCP (Coherence Extend/TCMP proxy protocols). The vulnerability resides in the product's Core component and is reachable over the network via TCP without credentials. No CWE was assigned in the source data, so the precise root-cause class is unstated; however, historical Coherence 'Core' network takeover issues of this profile have typically stemmed from unsafe deserialization of untrusted objects received over Coherence's cluster/proxy listeners, which is consistent with the reported unauthenticated network-to-takeover impact but cannot be confirmed from the provided data. The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 for each affected release line (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); Oracle distributes these as CPU patches rather than a single tagged version, so patch availability is per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html - consult that page for the exact patch/bundle numbers for your version. Until patching, reduce exposure by restricting network access to Coherence cluster and proxy/Extend TCP ports so they are reachable only from trusted application-tier hosts (firewall/security-group segmentation), which is low-risk for most tiered deployments but will break any legitimate cross-network client that relies on those listeners. Where Coherence Extend proxies are not required, disabling the Extend/TCP proxy listener removes the exposed surface at the cost of remote client connectivity. Given the unauthenticated network takeover profile, do not expose any Coherence port to untrusted networks or the internet.