What is the CVSS score of CVE-2026-60242?

CVE-2026-60242 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60242?

Oracle Coherence, a critical in-memory data grid component within Fusion Middleware deployments, is vulnerable to unauthenticated remote takeover that could expose cached business data including…

How to fix or mitigate CVE-2026-60242?

Within 24 hours, inventory all systems running Oracle Coherence versions 12.2.1.4.0 or 14.1.1.0.0 and immediately restrict network access to Coherence services by implementing firewall rules that block inbound HTTP/HTTPS connections from untrusted networks. Within 7 days, assess the sensitivity of data cached in affected Coherence instances, establish continuous monitoring for suspicious connection attempts to Coherence ports, and enable alerts for Oracle security advisories related to this CVE. Within 30 days, apply the vendor patch immediately upon release from Oracle, or execute a migration and upgrade plan to transition to patched Coherence versions or alternative caching solutions.

Oracle Coherence CVE-2026-60242

EUVD-2026-46657 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-4jpf-m8r5-vhrc

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor describes easily exploitable, unauthenticated, network HTTP takeover with full impact, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:46 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full remote takeover in Oracle Coherence 12.2.1.4.0 and 14.1.1.0.0 (Fusion Middleware Core component) allows an unauthenticated network attacker to compromise the in-memory data grid over HTTP with no user interaction. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, it was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable, unauthenticated' profile makes it a prime patching priority.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid (IMDG) used for caching, session management, and low-latency data access, frequently embedded in Oracle WebLogic Server and Fusion Middleware deployments. Cluster and management traffic in these products has historically been exposed over network listeners, and Coherence nodes exchange serialized objects between members and clients - a common root cause for takeover-class flaws in this ecosystem is unsafe deserialization of untrusted data. Oracle did not assign a CWE (CWE: N/A) and does not publish root-cause detail in its CPU advisories, so the exact mechanism is not confirmed from the provided data; the affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence:*, and the vendor tag 'Information Disclosure' is present although the CVSS reflects full C/I/A compromise, not disclosure alone.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; Oracle does not publish a standalone semantic fix version in the CVE data, so identify and apply the specific CPU patch for your Coherence 12.2.1.4.0 or 14.1.1.0.0 release from the CPU patch matrix. Oracle explicitly warns that CPU patches are cumulative and strongly recommends never running unsupported/unpatched versions. Until patching completes, reduce exposure with compensating controls: restrict network access to Coherence cluster and management/HTTP listener ports so they are reachable only from trusted application-tier hosts (segment via firewall/security groups), which prevents untrusted clients from reaching the vulnerable listener but requires accurate inventory of legitimate cluster members; place any Coherence-backed HTTP endpoints behind authenticated reverse proxies or WAF filtering; and disable or block external exposure of Coherence Extend/management endpoints if not required, accepting that remote clients relying on those endpoints will lose connectivity. These controls limit reachability but are not a substitute for the CPU patch.