What is the CVSS score of CVE-2026-60256?

CVE-2026-60256 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60256?

Oracle Coherence (versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0), a core enterprise middleware component used for distributed data management, is vulnerable to unauthenticated remote complete…

How to fix or mitigate CVE-2026-60256?

Within 24 hours, inventory all systems running Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and assess network exposure of affected instances. Within 7 days, implement network segmentation to restrict unauthenticated access to Coherence components, deploy intrusion detection rules to flag exploitation attempts, and validate that compensating controls are active. Within 30 days, establish an expedited patch deployment plan by monitoring Oracle's security advisories for released patches, and consider architectural changes such as air-gapping or network isolation of critical Coherence deployments to reduce exposure until vendor patches are available.

Oracle Coherence CVE-2026-60256

EUVD-2026-46671 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-w7m3-prr6-wp8r

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated (PR:N) network TCP access (AV:N) that is 'easily exploitable' (AC:L) with no interaction, yielding full takeover so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:40 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Coherence (Fusion Middleware Core component) is achievable by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 rating and permits complete takeover with high confidentiality, integrity, and availability impact against versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit identified at time of analysis, and it is not listed in CISA KEV; however, the low attack complexity and unauthenticated network vector make it a high-priority patch target.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform bundled with Oracle Fusion Middleware, commonly used to scale Java/WebLogic applications with clustered, high-availability caching. The defect resides in the Core component, which handles cluster membership and inter-node communication over TCP. Oracle does not assign a CWE (listed as N/A) and provides only a terse advisory, but 'unauthenticated network takeover' in Coherence historically maps to unsafe deserialization of untrusted data in the cluster/Extend protocol (CWE-502 class) - this remains inferred rather than confirmed. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence, spanning the 14.1.x and 15.1.x product lines.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 lines; Oracle publishes exact patched build numbers per product in the CPU matrix, so consult that advisory for the precise version rather than an assumed number, as no discrete fix version was provided in this input. Until patching is complete, restrict network exposure of Coherence cluster and Coherence*Extend/proxy TCP ports (commonly the cluster port and configured Extend proxy listeners) to trusted management segments via firewall/security-group rules, and place Coherence nodes behind network segmentation so untrusted clients cannot reach the grid - the trade-off is that overly tight rules can break legitimate cluster membership and Extend client connectivity, so validate cluster health after applying them. Where Coherence security/SSL and identity-based access controls are supported, enable authenticated and TLS-protected cluster/Extend communication to reduce anonymous reachability.