What is the CVSS score of CVE-2026-60249?

CVE-2026-60249 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle Coherence are affected by CVE-2026-60249?

Oracle Coherence, a core Fusion Middleware component, contains a critical vulnerability (CVSS 9.0) enabling complete compromise by low-privileged network attackers, with potential to impact dependent…

How to fix or mitigate CVE-2026-60249?

Within 24 hours: inventory all Oracle Coherence deployments across production and non-production environments, document versions, and implement emergency network segmentation isolating Coherence systems to restricted administrative subnets only. Within 7 days: restrict network access to only authorized systems and personnel, deploy enhanced logging to Coherence instances and forward events to SIEM for behavioral anomaly detection, and audit all privileged accounts with Coherence access for credential compromise. Within 30 days: establish a dedicated patch staging environment, subscribe to Oracle Critical Patch Update advisories for release notification, evaluate disabling or migrating non-critical Coherence instances to reduce attack surface, and document all remediation steps for audit and compliance reporting.

Oracle Coherence CVE-2026-60249

EUVD-2026-46664 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-m7ch-c4fr-jw8q

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.0 CRITICAL

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Adjacent segment access (AV:A) with low privileges (PR:L) and no interaction yields full CIA takeover plus scope change (S:C) impacting co-located products, matching Oracle's Critical rating.

3.1 AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:43 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.0

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Coherence executes to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Coherence (Oracle Fusion Middleware, Core component) is possible for a low-privileged attacker positioned on the same physical/logical network segment as the host, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.0 with a scope change, meaning successful exploitation not only results in takeover of Coherence itself but can significantly impact other products sharing the environment. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform used within Oracle Fusion Middleware to provide clustered, low-latency data services for Java applications and WebLogic deployments. Cluster members communicate over a dedicated network protocol (Coherence TCMP over TCP/UDP) across a shared communication segment, which aligns with the CVSS Adjacent (AV:A) attack vector - the attacker must reach the cluster's communication fabric rather than the open internet. Oracle did not assign a CWE (listed N/A); given the scope change (S:C) and full CIA takeover, the root cause class is most consistent with a deserialization or protocol-handling weakness in inter-node communication, though Oracle has not published the specific CWE. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence, and the vendor tags reference Information Disclosure alongside the broader takeover impact.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update for July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for your specific Coherence release among 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; Oracle does not publish standalone CVE fix versions outside the CPU, so consult the CPU patch matrix for the exact patch number matching your installation. Until patching is complete, reduce exposure of the Adjacent attack vector by isolating Coherence cluster (TCMP) traffic onto a dedicated, access-controlled network segment or VLAN and restricting which hosts can reach the cluster's communication ports - the trade-off is that misconfigured segmentation can partition or destabilize the cluster, so test in a staging environment. Enforce Coherence security features such as authorized-host filtering and TLS/SSL on cluster communication where supported, accepting the added latency and configuration overhead; and tighten the privileges of accounts that already have segment access, since PR:L means the attacker needs only low privileges. Do not rely on perimeter firewalls alone, because the threat model is an attacker already on the internal communication segment.