What is the CVSS score of CVE-2026-60250?

CVE-2026-60250 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60250?

Oracle Coherence in-memory data grid (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0) contains a critical unauthenticated network vulnerability (CVSS 9.8) enabling complete system…

How to fix or mitigate CVE-2026-60250?

Within 24 hours: identify all systems running Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and immediately implement firewall rules to restrict inbound TCP access to those systems to only trusted, authenticated network ranges and administrative consoles. Within 7 days: complete a comprehensive inventory of affected Coherence deployments, implement network segmentation to isolate Coherence systems from general network access if not already in place, deploy continuous monitoring and alerting for exploitation attempts targeting CVE-2026-60250, and subscribe to Oracle's Critical Patch Update bulletins. Within 30 days: as soon as Oracle releases a vendor patch for this vulnerability, test the patch thoroughly in non-production staging environments first, then deploy to production systems in a controlled phased manner, prioritizing internet-facing or high-risk systems.

Oracle Coherence CVE-2026-60250

EUVD-2026-46665 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-w848-r93p-w2vj

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated (PR:N) low-complexity (AC:L) TCP network (AV:N) access yielding full takeover, so C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:43 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Coherence (Oracle Fusion Middleware Core) is possible by unauthenticated attackers with TCP network access, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 9.8 and described by Oracle as 'easily exploitable,' allowing complete takeover of the in-memory data grid across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-takeover profile makes it a high-priority patch.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid used to cluster JVMs and share cached objects across nodes in Oracle Fusion Middleware and standalone Java deployments; nodes communicate over TCP (and historically the Coherence*Extend / TCMP cluster protocols). The affected component is 'Core.' Oracle did not assign a CWE (CWE: N/A), but 'takeover' via an unauthenticated network vector in a Java data-grid product is historically consistent with unsafe deserialization of untrusted objects received over the wire - a common root cause in Coherence and WebLogic advisories - though the specific weakness is not confirmed in the provided data. The CPE cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:* is version-wildcarded and does not itself delimit the fixed builds.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; the provided data does not include an exact fixed build number, so consult the CPU matrix for the precise patch for each of 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Until patched, reduce exposure by restricting network access to Coherence cluster and Coherence*Extend proxy TCP ports so only trusted application hosts can reach them (firewall/segmentation), disabling any internet-facing Coherence*Extend proxy listeners not required, and enabling TLS and authentication on Coherence*Extend/cluster transport where supported - trade-offs are that tightening cluster membership and proxy ACLs can break legitimate client connectivity and requires validating your client/proxy topology before enforcement.