What is the CVSS score of CVE-2026-60244?

CVE-2026-60244 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60244?

Oracle Coherence versions 12.2.1.4.0 and 14.1.1.0.0 contain a critical remote code execution vulnerability (CVSS 9.8) enabling complete platform takeover via unauthenticated HTTP requests requiring…

How to fix or mitigate CVE-2026-60244?

Within 24 hours, conduct inventory of all systems running Coherence 12.2.1.4.0 or 14.1.1.0.0 and isolate affected deployments from public or untrusted network access. Within 7 days, implement firewall rules restricting HTTP access to Coherence systems, enable comprehensive audit logging across all Coherence instances, and contact Oracle support to confirm patch timeline and request security guidance. Within 30 days, monitor Oracle Critical Patch Update announcements and apply the patched version immediately upon release; if upgrade is operationally infeasible, escalate to executive leadership for alternative deployment strategies or request backported fix from vendor.

Oracle Coherence CVE-2026-60244

EUVD-2026-46659 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-gqgw-5xhf-cgc2

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated HTTP-reachable, low-complexity exploitation yielding full takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:46 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full remote takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) in versions 12.2.1.4.0 and 14.1.1.0.0 is achievable by an unauthenticated attacker with only HTTP network access, per the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N with High Confidentiality, Integrity, and Availability impact (base score 9.8). Oracle rates it 'easily exploitable' and describes the outcome as complete compromise of Coherence. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial-access profile makes it a high-priority patch in the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching/clustering platform bundled with Oracle Fusion Middleware, frequently used to scale WebLogic and other Java EE application tiers. The affected code lives in the 'Core' component and is reachable over HTTP, which is consistent with the historical class of Coherence/WebLogic flaws driven by unsafe deserialization of untrusted data in the T3/IIOP/HTTP-fronted cluster and management interfaces. Oracle did not assign a CWE (CWE: N/A) and did not publish low-level technical detail, so the precise root cause is not confirmed; however, an unauthenticated 'takeover' over HTTP in a Java middleware grid product strongly points to remote-code-execution-grade deserialization or object-injection rather than a mere information-disclosure bug, despite the 'Information Disclosure' tag in the intelligence feed.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update - July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); this is patch-available per vendor advisory, though Oracle CPUs ship as quarterly patch bundles rather than a single named point release, so identify the exact Coherence patch for your 12.2.1.4.0 or 14.1.1.0.0 baseline from the advisory's patch matrix (no exact fix version is independently confirmed here). Until patched, reduce exposure by restricting network reachability of Coherence cluster and management HTTP ports to trusted management segments only (breaks any remote/inter-tier access that legitimately crosses those boundaries), placing Coherence behind a reverse proxy or firewall that denies untrusted HTTP, and - where Coherence uses Java serialization over the wire - enforcing serialization allowlists/filters (JEP 290 jdk.serialFilter) which can reject unexpected classes but may disrupt legitimate cluster traffic if misconfigured. Prioritize patching over these compensating controls given the unauthenticated, network-reachable nature of the flaw.