What is the CVSS score of CVE-2026-60245?

CVE-2026-60245 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Oracle Coherence are affected by CVE-2026-60245?

Oracle Coherence, a core Fusion Middleware component, contains a privilege escalation vulnerability that could allow existing local account holders to compromise data confidentiality and integrity…

How to fix or mitigate CVE-2026-60245?

Within 24 hours, conduct a complete inventory of Oracle Coherence deployments in your environment and flag all systems in production. Within 7 days, restrict local logon access to Coherence systems to essential administrative personnel only, review existing local account privileges, and implement logging for authentication and privilege escalation events on affected servers. Within 30 days, apply Oracle's July 2026 Critical Patch Update to all Coherence systems as soon as it becomes available, beginning with test deployments to validate compatibility with your specific configuration before production deployment.

Oracle Coherence CVE-2026-60245

EUVD-2026-46660 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-mfjq-h763-hjrf

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

7.2 HIGH

Local logon and an existing account give AV:L/PR:L; difficult non-deterministic exploitation needing separate victim action gives AC:H/UI:R; cross-product impact gives S:C with C:H/I:H and no availability effect.

3.1 AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:L/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:46 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Coherence executes to compromise Oracle Coherence. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Coherence accessible data as well as unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N).

AnalysisAI

Privilege escalation with scope change in Oracle Coherence (Oracle Fusion Middleware Core component) lets a low-privileged attacker with local logon access compromise the confidentiality and integrity of all Coherence-accessible data and impact additional products beyond Coherence itself. Oracle rates it CVSS 3.1 7.2, but the attack is hard to execute: it requires an existing account, high attack complexity, and human interaction from a separate victim. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the fix ships in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Coherence is Oracle's distributed in-memory data grid used within Fusion Middleware for caching, session state, and low-latency data access across clustered WebLogic/middleware tiers. The flaw resides in the Core component and, per the CVSS scope change (S:C), a successful compromise of Coherence can pivot to affect other products sharing the same security authority - consistent with Coherence's role as shared infrastructure across an application stack. Oracle assigned no CWE (CWE: N/A); the intelligence tag labels it 'Authentication Bypass,' but the CVSS vector's PR:L (low privileges required) indicates the attacker must already be authenticated to the infrastructure, so the tag should be treated cautiously rather than as a true pre-auth bypass.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026 for the affected Coherence release train (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html - no standalone fixed build number was published in the input, so consult that advisory for the exact patch bundle per version. Until patched, reduce the attack surface by tightly restricting local and interactive logon and account privileges on hosts where Coherence executes (the attack requires PR:L local access), and limit which low-privileged users can reach the Coherence process, since removing local footholds directly negates the AV:L vector; because exploitation also depends on UI:R, reinforce operational controls so administrators and users do not perform attacker-supplied actions. Trade-off: hardening local access and privilege separation may disrupt operational or automation accounts that legitimately run on the Coherence host, so validate service dependencies before restricting them.