What is the CVSS score of CVE-2026-60247?

CVE-2026-60247 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60247?

Oracle Coherence versions 12.2.1.4.0 and 14.1.1.0.0 contain a critical remote code execution vulnerability (CVSS 9.8) permitting unauthenticated attackers to achieve complete system takeover using…

How to fix or mitigate CVE-2026-60247?

Within 24 hours, inventory all Coherence deployments to identify systems running versions 12.2.1.4.0 or 14.1.1.0.0; immediately restrict HTTP access to these systems to authorized administrative networks only and deploy network intrusion detection signatures for CVE-2026-60247 patterns. Within 7 days, implement strict network segmentation isolating Coherence services from production networks; evaluate shutdown of non-critical Coherence instances. Within 30 days, monitor Oracle security advisories for patch releases, develop and execute an upgrade plan to unaffected Coherence versions, and for systems that cannot be immediately remediated, implement additional layered compensating controls.

Oracle Coherence CVE-2026-60247

EUVD-2026-46662 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-xp2v-v3vx-vg6j

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated network HTTP access with low complexity (AV:N/AC:L/PR:N/UI:N) and full product takeover, justifying C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:44 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (Oracle Fusion Middleware Core component) affects versions 12.2.1.4.0 and 14.1.1.0.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the product. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, Oracle describes the flaw as easily exploitable and resulting in complete Coherence takeover. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not currently listed in CISA KEV.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform, part of Oracle Fusion Middleware, commonly embedded in WebLogic-based enterprise application tiers for scalable clustering, session management, and low-latency data access. The affected component is the product Core, and the CPE identifies the software as cpe:2.3:a:oracle_corporation:oracle_coherence. Oracle assigned no CWE (CWE: N/A), so the precise root-cause class is not disclosed; however, the combination of network HTTP vector, unauthenticated access, and full takeover impact is characteristic of unsafe request processing or deserialization-style flaws frequently seen in Coherence/WebLogic middleware, though this specific mechanism is not confirmed in the source data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (patch available per vendor advisory; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch bundle mapped to your 12.2.1.4.0 or 14.1.1.0.0 installation, as Oracle distributes CPU patches per product/version rather than a single tagged release string in the feed). Until patching, reduce exposure by restricting network access to Coherence cluster and management HTTP ports to trusted hosts only via firewall/segmentation, placing the middleware tier behind authenticated reverse proxies, and disabling any externally reachable Coherence extend/HTTP listeners that are not required - with the trade-off that legitimate cross-tier or client access must be explicitly allowlisted, which can break distributed clients if scoped too tightly. Because this is unauthenticated and network-facing, do not rely on compensating controls as a long-term substitute for the CPU patch.