What is the CVSS score of CVE-2026-60248?

CVE-2026-60248 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle Coherence are affected by CVE-2026-60248?

Oracle Coherence, a critical enterprise middleware component, is affected by a CVSS 9.3 vulnerability enabling complete system compromise.

How to fix or mitigate CVE-2026-60248?

Within 24 hours: immediately identify all Oracle Coherence (Fusion Middleware Core) instances in the environment and catalog systems with production dependencies; declare emergency change control status for Coherence systems. Within 7 days: implement local logon access restrictions to authorized administrators only on all Coherence hosts; deploy network segmentation to isolate Coherence nodes from untrusted network sources; enable enhanced monitoring and alerting on Coherence processes and system-level events. Within 30 days: establish vendor engagement with Oracle to confirm patch timeline and commitment dates; evaluate and implement air-gapping of critical Coherence clusters if patch remediation extends beyond 60 days.

Oracle Coherence CVE-2026-60248

EUVD-2026-46663 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-21 oracle

GHSA-cjxw-qf69-w2xm

Privilege Escalation Oracle Oracle Coherence Oracle Corporation

9.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.3 CRITICAL

AV:L and PR:N because a host logon is required but no Coherence auth; AC:L and S:C with full C/I/H impact per Oracle's easily-exploitable takeover with cross-product effect.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:44 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.3

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Coherence executes to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Coherence (Fusion Middleware Core component) is possible by an unauthenticated attacker who holds a local logon on the host where Coherence runs, per Oracle's July 2026 Critical Patch Update. The flaw scores CVSS 9.3 because a successful attack yields complete confidentiality, integrity, and availability loss and, via a scope change, can significantly impact additional products beyond Coherence itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable.'

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching/clustering platform bundled with Oracle Fusion Middleware, commonly used to scale Java (WebLogic) enterprise applications. The affected element is the Core component across supported branches 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle did not assign a CWE (CWE: N/A) and does not publish root-cause detail; the CVSS scope change (S:C) plus 'takeover' language indicates the vulnerable Coherence process can be leveraged to affect resources managed by a different security authority - consistent with Coherence's role as a clustering/serialization layer shared by other middleware. The tag 'Information Disclosure' understates the assessed impact, since all three CIA metrics are High.

RemediationAI

Vendor-released patch: apply the Oracle Critical Patch Update of July 2026 (cpujul2026) for the affected Coherence branches (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) per https://www.oracle.com/security-alerts/cpujul2026.html - Oracle publishes exact patch/bundle numbers per version in that CPU. Because exploitation requires an interactive/logon foothold on the Coherence host, the most effective compensating controls until patching are to restrict and audit local logon rights on Coherence/WebLogic servers (remove unnecessary shell/RDP/SSH accounts), enforce least privilege and OS-level isolation for the process account, and segment these hosts so untrusted or lower-tier users cannot obtain a session; note these controls reduce but do not eliminate risk and may disrupt operational access for administrators and batch jobs. Given the scope change, also review trust relationships and shared credentials between Coherence and dependent WebLogic/Fusion Middleware components so a Coherence takeover cannot pivot laterally.