What is the CVSS score of CVE-2026-60240?

CVE-2026-60240 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60240?

Oracle Coherence, a core Oracle Fusion Middleware component, is vulnerable to unauthenticated remote takeover affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

How to fix or mitigate CVE-2026-60240?

Within 24 hours, identify all systems running Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and map their network exposure and data sensitivity. Within 7 days, implement immediate network segmentation to restrict TCP access to Coherence instances-limit connectivity strictly to authorized systems and disable unnecessary services; establish detailed audit logging on all access attempts. Within 30 days, monitor Oracle's security advisories for patch availability and prepare a full remediation plan; contact Oracle support to determine if interim builds are available; concurrently evaluate architectural alternatives for systems where downtime during patching is unacceptable.

Oracle Coherence CVE-2026-60240

EUVD-2026-46655 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-v3jg-jwwj-vvx4

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes unauthenticated TCP-based, easily-exploitable takeover with full CIA loss, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; scope unchanged as compromise is of Coherence itself.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:47 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated attacker with TCP network access to fully compromise the product across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this 'easily exploitable' with complete confidentiality, integrity and availability loss (CVSS 9.8), disclosed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patch.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid used to cache and manage application state at scale, commonly embedded within Oracle Fusion Middleware and WebLogic Server deployments for clustered Java (JEE) applications. Cluster members communicate over TCP/TCMP and expose management/extend proxy endpoints, which are the typical exposure surface for the affected 'Core' component. Oracle did not assign a CWE (CWE: N/A) and does not publish root-cause detail, but 'takeover' of a Java data-grid node via an unauthenticated network request is historically consistent with unsafe deserialization or protocol-handling flaws in the cluster/proxy layer; this specific mechanism is not confirmed in the available data. The single CPE provided (cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:*) is a wildcard version match and does not itself delimit the affected versions - those come from the description.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update (CPU) of July 2026 - see https://www.oracle.com/security-alerts/cpujul2026.html - which is the primary remediation; consult that advisory for the exact patched build for each affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0), as no single exact fix version is stated in the available data (patch available per vendor advisory). Until patched, reduce exposure with concrete compensating controls: restrict network access to Coherence cluster (TCMP) and Extend/proxy TCP ports so they are reachable only from trusted application-tier hosts via firewall/security-group allow-lists (side effect: cluster members and Extend clients outside the allow-list will lose connectivity, so scope carefully); ensure no Coherence port is exposed to the internet or untrusted VLANs; and where supported, enable TLS/authentication on Coherence Extend and cluster communication to raise the bar for anonymous access. Do not rely on the 'Information Disclosure' tag to downscope patching - the CVSS vector indicates full integrity and availability impact as well.