What is the CVSS score of CVE-2026-60251?

CVE-2026-60251 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60251?

Oracle Coherence (Oracle Fusion Middleware) is vulnerable to remote system compromise without authentication, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

How to fix or mitigate CVE-2026-60251?

Within 24 hours, identify all systems running Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and categorize by criticality and network exposure. Within 7 days, implement firewall rules restricting TCP access to Coherence ports to essential internal hosts only; audit administrator accounts and review access logs for anomalies; disable remote management interfaces if not actively required. Within 30 days, monitor Oracle's next Critical Patch Update for a permanent fix and establish rapid deployment procedures; consider temporary mitigation through network isolation, system shutdown, or migration to alternative caching solutions if Coherence is not mission-critical.

Oracle Coherence CVE-2026-60251

EUVD-2026-46666 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-6hvj-6w92-pcrj

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor confirms unauthenticated, easily exploitable network TCP access (AV:N/AC:L/PR:N/UI:N) resulting in full node takeover, so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:43 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated attacker with TCP network access to fully compromise the product across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this CVSS 9.8 with high confidentiality, integrity, and availability impact, and describes it as 'easily exploitable,' meaning no authentication, user interaction, or special conditions are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and complete-takeover impact make it a high-priority patch in the July 2026 Oracle Critical Patch Update.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid and caching platform used in Java-based enterprise middleware to cluster application state across nodes over TCP (Coherence*Extend / cluster and proxy services typically listen on network ports such as the well-known 9000/8088 range and cluster ports). The flaw resides in the Core component and is reachable directly over TCP by a network-positioned attacker without credentials. Oracle does not assign a CWE (CWE: N/A) for this advisory; however, the combination of unauthenticated network reachability, low complexity, and full compromise is characteristic of Coherence-class weaknesses such as unsafe deserialization of untrusted objects received over the cluster/proxy protocol, a recurring root cause in Java middleware data grids. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence:*, confirming the Coherence product line rather than a specific bundled application.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update immediately for each affected release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0), following the fix matrix in the advisory at https://www.oracle.com/security-alerts/cpujul2026.html; the CPU is the authoritative source for the exact patch/bundle identifiers per version (Patch available per vendor advisory - no standalone fix version string was included in this input, so confirm the specific bundle patch number from the CPU). Until patched, reduce exposure by restricting network reachability of Coherence cluster and proxy/extend TCP ports to trusted management segments only, using host firewalls or network ACLs to block access from untrusted networks and the internet - the trade-off is that legitimate remote Coherence*Extend clients must be explicitly allowlisted or they will lose connectivity. Where feasible, enable Coherence transport security (SSL/TLS and identity/authorization on proxy services) and disable any unauthenticated proxy or Extend listeners that are not strictly required, accepting that this may require client-side configuration changes. Monitor Coherence and middleware hosts for anomalous connections to cluster ports as a detective control while remediation is scheduled.