What is the CVSS score of CVE-2026-60241?

CVE-2026-60241 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60241?

Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a critical unauthenticated remote code execution vulnerability enabling complete system takeover.

How to fix or mitigate CVE-2026-60241?

Begin immediate response: within 24 hours, inventory all Coherence deployments to identify affected versions, assess network exposure (especially internet-facing instances), and initiate incident response planning assuming potential compromise risk. Over the next 7 days, implement network segmentation restricting Coherence cluster access to authorized administrative networks only, deploy intrusion detection and web application firewall rules on Coherence service ports (default 7070), enable comprehensive audit logging with real-time alerting on all Coherence activity, and restrict administrative access through multi-factor authentication and IP whitelisting. Within 30 days, upgrade to patched Coherence versions as Oracle releases critical patch updates (monitor Oracle Security Alerts for versions 14.1.2.1.0, 14.1.3.0.0, or 15.1.2.0.0), or if upgrade timeline exceeds acceptable risk exposure, migrate non-critical Coherence workloads to alternative infrastructure and conduct comprehensive forensic log analysis for indicators of compromise.

Oracle Coherence CVE-2026-60241

EUVD-2026-46656 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-x4ww-v95c-7gcp

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated HTTP-reachable, easily exploitable takeover with full CIA impact, supporting AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:47 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote code execution and full takeover in Oracle Coherence (Oracle Fusion Middleware, Core component) versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows an unauthenticated attacker with HTTP network access to completely compromise the product, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector and 'takeover' impact make it a top-priority patch candidate.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform bundled with Oracle Fusion Middleware, used to scale application state and clustering across enterprise Java deployments. The vulnerability resides in the Core component and is reachable over HTTP, which is consistent with Coherence's management/extend/REST-facing services that accept remote requests. No CWE was assigned in the source data, so the precise root-cause class (e.g., deserialization, injection, or authentication bypass) cannot be confirmed from the provided intelligence; the 'takeover' language and full CIA impact are typical of unsafe deserialization or a remote code execution path in Java middleware, but this is inference, not vendor confirmation. The only CPE provided is cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:*, which does not pin exact version boundaries and must be cross-referenced with the version list in the description.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory) documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle CPUs ship cumulative patches per Coherence version line (14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0), so identify your exact release and apply the corresponding CPU patch - no standalone fixed build number was provided in the input, so confirm the precise patch level from the CPU matrix. Because exploitation is over HTTP by an unauthenticated attacker, until patching is complete restrict network reachability to Coherence management, Extend/proxy, and any HTTP-facing endpoints by placing them behind a firewall or internal-only segment and blocking untrusted access to the listening ports, accepting that this may disrupt legitimate remote clients or clustering across network boundaries. Where feasible, disable or bind Coherence Extend/REST and management HTTP listeners to trusted interfaces only and enforce authentication/TLS on cluster and proxy traffic, with the trade-off that these controls can break applications relying on open remote access.