What is the CVSS score of CVE-2026-60261?

CVE-2026-60261 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Coherence are affected by CVE-2026-60261?

Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are vulnerable to complete cluster compromise by attackers with network access, enabling unauthorized data access and…

How to fix or mitigate CVE-2026-60261?

Within 24 hours: Conduct an urgent inventory of all Oracle Coherence deployments to identify affected versions and their network locations. Within 7 days: Implement firewall rules restricting access to Coherence cluster communication ports from only authorized sources; implement network segmentation to isolate affected clusters from untrusted network segments; disable any unnecessary inter-cluster communication if operationally feasible. Within 30 days: Review Oracle's July 2026 Critical Patch Update for available fixed versions and plan upgrade strategy; test fixed versions in pre-production; deploy upgrades to all affected Coherence clusters.

Oracle Coherence CVE-2026-60261

EUVD-2026-46676 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-cff8-9w24-w925

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Adjacent segment access is required (AV:A) but no auth or interaction (PR:N/UI:N) and low complexity, and takeover yields full C/I/A impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:39 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Coherence executes to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Coherence (Core component) is possible for an unauthenticated attacker who can reach the cluster's physical communication segment, per Oracle's July 2026 Critical Patch Update. Affected releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 can be taken over completely, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, AV:A). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but Oracle rates it 'easily exploitable' with no privileges or user interaction required.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid and caching platform bundled with Oracle Fusion Middleware, used to scale Java application state across a cluster. Cluster members discover and communicate with each other over Coherence's TCMP (Tangosol Cluster Management Protocol) traffic on a shared network segment, which is exactly the 'physical communication segment' the CVSS Adjacent (AV:A) vector points to. The affected 'Core' component handles this intra-cluster messaging, and a takeover outcome combined with the 'Information Disclosure' tag is consistent with an unsafe-deserialization or trust-of-cluster-peer class of flaw, though Oracle did not assign a CWE (CWE: N/A), so the precise root cause is not confirmed in the available data. The CPE cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:* confirms the affected product but does not enumerate version boundaries; those come from the description.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though an exact fixed build number is not stated in the provided data, so consult the CPU matrix for the specific patch corresponding to your Coherence release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0). Because the vector is Adjacent, the most effective compensating control until patching is to isolate Coherence cluster (TCMP) traffic onto a dedicated, firewalled VLAN or backend segment and restrict which hosts can join or reach that segment - this directly removes the attacker's required position but must be validated so legitimate cluster members are not partitioned. Additional hardening includes enabling Coherence's well-known-addresses (WKA) and TLS/SSL for cluster and Extend communication and restricting Extend proxy listener ports to trusted clients, with the trade-off of added configuration and certificate management overhead. Do not rely on internet-edge firewalls alone, since the threat model is an attacker already on the local segment.