What is the CVSS score of CVE-2026-60257?

CVE-2026-60257 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60257?

Oracle Coherence-a critical distributed caching component used across Oracle Fusion Middleware deployments-is vulnerable to complete remote takeover by unauthenticated attackers in versions…

How to fix or mitigate CVE-2026-60257?

Within 24 hours, identify and inventory all Oracle Coherence instances (versions 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0) across production and non-production systems, then immediately implement network-level access restrictions limiting Coherence service connectivity (default port 7574) to only authorized internal applications. Within 7 days, deploy monitoring and alerting for anomalous network patterns to Coherence services; establish daily communication with Oracle support for patch availability and create internal escalation procedures. Within 30 days, finalize and test a rapid-deployment plan for patching all affected Coherence instances as patches become available, including fallback procedures; simultaneously, begin evaluation of version upgrades or alternative middleware solutions in case patch availability is delayed beyond acceptable risk tolerance.

Oracle Coherence CVE-2026-60257

EUVD-2026-46672 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-7q7w-rmcf-8945

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easily exploitable unauthenticated TCP access with no user interaction yielding full product takeover, so AV:N/AC:L/PR:N/UI:N with C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:40 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full remote takeover of Oracle Coherence (Core component of Oracle Fusion Middleware) is achievable by an unauthenticated network attacker in supported releases 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates the flaw CVSS 9.8 and describes it as 'easily exploitable' over TCP with no user interaction, yielding complete compromise of confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a top-priority patch from the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform bundled with Oracle Fusion Middleware, commonly used to scale stateful Java/WebLogic applications by clustering data across JVM nodes that communicate over TCP (Coherence*Extend / cluster protocols). The vulnerability sits in the 'Core' component and is reachable over the network via TCP, which is consistent with Coherence's cluster and proxy listener services. Oracle did not assign a CWE (CWE: N/A) and publishes no root-cause detail, but 'takeover' via an unauthenticated network protocol in a Java data-grid product is historically associated with unsafe deserialization of untrusted data reaching cluster/proxy listeners; this class attribution is inferred, not confirmed. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence, covering the Coherence product line across the named releases.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which contains the fix for CVE-2026-60257; Oracle distributes Coherence fixes as CPU patch bundles rather than a single tagged version, so apply the CPU patch corresponding to your installed release train (14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0) - Patch available per vendor advisory, no standalone fix version was published in the input. Until patching, reduce exposure by network-restricting Coherence cluster and Coherence*Extend proxy TCP listener ports so they are reachable only from trusted application hosts (via firewall/security groups or binding listeners to internal interfaces), which prevents untrusted network access but will break connectivity for any legitimate remote extend clients that are not whitelisted. Where Coherence supports it, enable TLS/SSL and authentication on cluster and proxy communication and disable any unauthenticated extend proxy that is not required, accepting that enabling transport security may require client-side configuration changes. Verify no Coherence listener ports are exposed to the internet or untrusted VLANs.