What is the CVSS score of CVE-2026-60237?

CVE-2026-60237 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Coherence CVE-2026-60237

EUVD-2026-46652 MEDIUM

Information Exposure (CWE-200)

2026-07-21 oracle

GHSA-qhxp-h592-59vf

Information Disclosure Oracle Oracle Coherence Oracle Corporation

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network TCP service with authentication bypass yields AV:N and PR:N; read-only data exposure limits confidentiality to L with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:13 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized data read in Oracle Coherence Core enables unauthenticated remote attackers to access a subset of data stored within the in-memory data grid via TCP, with no credentials or user interaction required. Affected versions span the three current release trains: 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, all part of Oracle Fusion Middleware. No public exploit identified at time of analysis; the 'Authentication Bypass' tag combined with a PR:N vector confirms the Core component fails to enforce access controls on inbound TCP connections.

Technical ContextAI

Oracle Coherence is an enterprise-grade, distributed in-memory data grid within the Oracle Fusion Middleware stack, used primarily for high-performance caching and clustered data management over TCP-based cluster communication protocols. The affected component is the Core, which manages data partitioning, cluster membership, and client connectivity. The CPE cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:* confirms scope across all builds of the named versions. CWE is listed as N/A in available data, but the 'Authentication Bypass' tag indicates the root cause is an authentication enforcement gap in the Core's TCP service layer - clients can issue read requests without presenting valid credentials or session tokens. The CVSS vector's AC:L and PR:N reinforce that no special conditions or elevated access are needed to trigger the bypass.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact fixed build numbers for each release train (14.1.1.0.x, 14.1.2.0.x, 15.1.1.0.x) should be confirmed directly from the CPU advisory, as specific patch versions are not independently stated in available intelligence. As a compensating control prior to patching, restrict TCP access to Oracle Coherence cluster and extend ports (default: 7574, 9000, and any custom cluster ports) to trusted application server networks only using host-based or perimeter firewall rules; this eliminates the network vector for unauthenticated external clients with no functional impact on internal cluster members. Additionally, enabling Coherence access control or TLS mutual authentication, where supported by the deployed version, would impose an authentication barrier as a defense-in-depth measure.