What is the CVSS score of CVE-2026-60254?

CVE-2026-60254 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60254?

Oracle Coherence (a core middleware component of Oracle Fusion Middleware) is vulnerable to unauthenticated remote code execution with a CVSS score of 9.8, allowing complete compromise of affected…

How to fix or mitigate CVE-2026-60254?

Within 24 hours, execute an inventory of all Oracle Coherence deployments to identify affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) and isolate instances from untrusted networks via firewall rules blocking inbound network access. Within 7 days, deploy network-based intrusion detection focused on Coherence port traffic (default 7574), disable remote JMX management if enabled, enforce strict network segmentation between Coherence clusters and external-facing systems, and maintain comprehensive access logging. Within 30 days, monitor Oracle's monthly patch updates for a remediated version, prepare a hardened deployment architecture with Coherence running only within trusted network zones, and evaluate alternative products if patching timelines prove unacceptable.

Oracle Coherence CVE-2026-60254

EUVD-2026-46669 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-94pp-5782-x8jh

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easily exploitable unauthenticated TCP takeover with no user interaction, so AV:N/AC:L/PR:N/UI:N with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:42 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Unauthenticated remote takeover of Oracle Coherence (a component of Oracle Fusion Middleware, Core component) lets a network attacker with only TCP connectivity fully compromise the affected instance, per Oracle's July 2026 Critical Patch Update. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and the CVSS 3.1 base score of 9.8 reflects complete loss of confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the 'easily exploitable / unauthenticated' framing makes it a high-priority patch.

Technical ContextAI

Oracle Coherence is an in-memory distributed data grid (IMDG) used for scalable clustered caching, session storage and low-latency data access, commonly deployed alongside Oracle WebLogic Server within Fusion Middleware stacks. Coherence nodes communicate over TCP using cluster (TCMP) and client-facing Coherence*Extend proxy protocols, which historically process serialized Java objects; Oracle attributes the flaw to the 'Core' component. Oracle assigned no CWE (CWE: N/A), so the exact root-cause class is not confirmed in the input - though unauthenticated, network-reachable full-takeover bugs in this product family are typically driven by unsafe deserialization or protocol-handling flaws in the proxy/cluster listeners; this remains inferred, not vendor-stated. The affected product is identified by CPE cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:* with no version bound encoded, so the authoritative version list comes from the CPU text.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026 as the primary fix; Oracle addresses this in the CPU (Patch available per vendor advisory) and the fixed patch levels for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are documented at https://www.oracle.com/security-alerts/cpujul2026.html - no standalone fix-version string is given in the input, so obtain the exact patch number from that advisory. Because exploitation is unauthenticated and network-based, until patching is complete restrict TCP access to Coherence cluster (TCMP) and Coherence*Extend proxy listener ports so they are reachable only from trusted application hosts via firewall or network segmentation, and never expose any Coherence port to untrusted networks or the internet; note that over-restricting these ports can break legitimate cluster membership and Extend clients, so scope rules to known peers. Where supported, enable Coherence transport security (TLS/SSL and identity-based access on Extend proxies) as a compensating control, accepting the configuration and performance overhead. These network controls reduce exposure but are not a substitute for the vendor patch.