What is the CVSS score of CVE-2026-60253?

CVE-2026-60253 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60253?

A critical vulnerability in Oracle Coherence enables complete system compromise through unauthenticated remote access, affecting organizations running Oracle Fusion Middleware versions 12.2.1.4.0…

How to fix or mitigate CVE-2026-60253?

Within 24 hours, inventory all Oracle Coherence deployments and identify instances running affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); assess which systems access sensitive data or critical applications. Within 7 days, implement strict network segmentation isolating affected Coherence instances, configure firewall rules to restrict inbound access to trusted sources only, disable unnecessary remote management features, and enable detailed logging on all connection attempts. Within 30 days, establish communication with Oracle regarding patch availability and upgrade timelines, develop a migration plan to unaffected versions, and evaluate whether non-critical Coherence deployments can be temporarily suspended to reduce organizational risk.

Oracle Coherence CVE-2026-60253

EUVD-2026-46668 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-wxgc-m284-52jc

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states easily exploitable unauthenticated network TCP takeover with full CIA impact, so AV:N/AC:L/PR:N/UI:N and C/I/A:H; scope unchanged as compromise stays within Coherence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:42 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Coherence, the in-memory data grid component of Oracle Fusion Middleware (Core), allows an unauthenticated remote attacker with only TCP network access to take over the affected instance. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, it affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and was disclosed by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided in the input.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid and caching platform used to scale stateful applications across a cluster, typically deployed as part of Oracle Fusion Middleware and WebLogic Server environments. Cluster members communicate over TCP (and Coherence*Extend proxy services), and historically the highest-severity Coherence flaws have stemmed from unsafe deserialization of cluster or client traffic reaching an exposed listener. Oracle attributes this to the 'Core' component and classifies impact as 'takeover of Oracle Coherence,' but the specific root-cause class is not published - the CWE is listed as N/A in the input, so the exact weakness (e.g., deserialization or authentication bypass) cannot be confirmed from the provided data.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update fixes for Oracle Coherence as documented at https://www.oracle.com/security-alerts/cpujul2026.html, which covers versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; Oracle does not publish a single fix build in the input, so consult the CPU patch matrix for the exact patch/bundle for your version (Patch available per vendor advisory). Until patching completes, restrict network reachability of Coherence cluster and Coherence*Extend proxy TCP ports to trusted hosts only via firewall/security-group rules and network segmentation, since the vector is unauthenticated TCP - the trade-off is that overly broad blocking can break legitimate cluster members or extend clients, so scope rules to known peer addresses. Where feasible, place Coherence behind a VPN/internal-only boundary and disable or lock down any externally exposed proxy service; these controls reduce exposure but are not a substitute for the CPU patch.