What is the CVSS score of CVE-2026-60258?

CVE-2026-60258 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60258?

Oracle Coherence (core data-grid component of Oracle Fusion Middleware) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are vulnerable to unauthenticated remote takeover with CVSS 9.8,…

How to fix or mitigate CVE-2026-60258?

Within 24 hours: Complete inventory of all systems running Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and identify network reachability from untrusted sources; implement firewall rules and network segmentation immediately to restrict TCP access to Coherence instances to authorized internal systems only. Within 7 days: Deploy network monitoring and alerting to detect unauthorized connection attempts to Coherence instances, contact Oracle support for official patch timeline and interim guidance, and document all isolation measures implemented. Within 30 days: Establish dedicated testing environment and validate any vendor-released patches; execute staged patching across all affected Coherence versions following change management procedures.

Oracle Coherence CVE-2026-60258

EUVD-2026-46673 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-qm2j-2w85-7323

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor confirms unauthenticated (PR:N), network TCP (AV:N), easily exploitable (AC:L) takeover with full CIA impact and no scope change, matching a 9.8 base.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:40 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (Core component of Oracle Fusion Middleware) allows an unauthenticated attacker with TCP network access to fully compromise the affected data-grid instance across versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates it "easily exploitable" with a CVSS 3.1 base score of 9.8 and full confidentiality, integrity and availability impact. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch target.

Technical ContextAI

Oracle Coherence is an in-memory distributed data grid used to scale and cache application state, most commonly deployed alongside Oracle WebLogic Server within Fusion Middleware stacks. Cluster and client communication occurs over TCP (Coherence*Extend and the internal cluster/TCMP transport), which is the network surface referenced by the CVSS AV:N/PR:N vector. The advisory does not assign a CWE (listed as N/A) and does not name the exact defect class; however, Oracle's phrasing of an unauthenticated network 'takeover' of a Java middleware component is historically consistent with unsafe deserialization of untrusted objects reaching the grid over its wire protocol - this root cause is inferred, not confirmed by the source data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory) - consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch bundle mapping to your version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0); Oracle publishes the specific fix numbers there and no exact fixed build string is provided in this input to reproduce here. Until the CPU is applied, reduce exposure by restricting network reachability to Coherence TCP listeners (cluster/TCMP and Coherence*Extend proxy ports) to only trusted application tiers via firewall/ACLs or network segmentation, which prevents untrusted clients from reaching the vulnerable transport but requires an accurate inventory of legitimate cluster members and clients to avoid breaking clustering. Where deserialization is the suspected vector, enabling and tightening any available serialization allow-lists/filters (e.g. JDK or Coherence serialization filtering) can raise the exploitation bar, at the cost of testing to ensure legitimate object types are not blocked. Do not expose any Coherence port to the internet.