What is the CVSS score of CVE-2026-60246?

CVE-2026-60246 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60246?

Oracle Coherence in Oracle Fusion Middleware versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 is vulnerable to unauthenticated remote takeover (CVSS 9.8), threatening any organization that…

How to fix or mitigate CVE-2026-60246?

Within 24 hours: Conduct inventory of all Oracle Fusion Middleware deployments running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 with Coherence enabled; immediately identify network-accessible instances and apply network segmentation or access restrictions if immediate patching is not possible. Within 7 days: Apply the July 2026 Critical Patch Update for Oracle Fusion Middleware to all affected production and critical-tier systems; validate successful patch deployment and test Coherence cluster functionality. Within 30 days: Complete patching of all remaining development, staging, and non-critical production systems; conduct network audit to ensure all Coherence instances are restricted to trusted internal networks and not exposed to untrusted or external-facing segments.

Oracle Coherence CVE-2026-60246

EUVD-2026-46661 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-jcq8-3626-mf7m

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated TCP-reachable takeover with no user interaction gives AV:N/AC:L/PR:N/UI:N, and stated full product compromise justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:45 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Coherence is possible by unauthenticated remote attackers over TCP against the Core component in Oracle Fusion Middleware versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this 'easily exploitable' with full confidentiality, integrity, and availability compromise (CVSS 9.8), fixed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so exploitation is currently theoretical but the barrier is minimal.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform bundled with Oracle Fusion Middleware, used for clustering and low-latency state sharing across application tiers. The affected 'Core' component handles the cluster/proxy protocol that Coherence nodes and Coherence*Extend clients use to communicate over TCP. The CPE (cpe:2.3:a:oracle_corporation:oracle_coherence) confirms the application-layer product across the listed release trains. No CWE was assigned in the input, but the combination of unauthenticated TCP access, 'easily exploitable', and full takeover is consistent with unsafe deserialization of untrusted cluster/proxy traffic - a recurring root-cause class in Java middleware - though the exact weakness class is not confirmed in the available data. Oracle's own tag labels this 'Information Disclosure', which understates the stated CIA=High/takeover impact and should be treated cautiously.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html) for your Coherence release train; consult that CPU matrix for the exact patched bundle corresponding to 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0, as Oracle publishes fix identifiers per version rather than a single tag. Until patching completes, restrict network reachability of Coherence cluster and Coherence*Extend proxy TCP ports to trusted management segments via firewall/security-group rules and place proxies behind authenticated, TLS-enabled listeners - trade-off: tightening proxy access may break remote Extend clients and cross-datacenter clustering, so validate client connectivity after changes. Avoid exposing any Coherence port to untrusted or internet-facing networks, and enable Coherence security/authorized-hosts and SSL socket providers where supported to reduce the unauthenticated attack surface, accepting the added configuration and certificate-management overhead.