What is the CVSS score of CVE-2026-60262?

CVE-2026-60262 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60262?

Oracle Coherence, a core enterprise data-caching component in Fusion Middleware deployments, is vulnerable to unauthenticated remote takeover with a 9.8 CVSS score affecting versions 12.2.1.4.0,…

How to fix or mitigate CVE-2026-60262?

Within 24 hours: Conduct emergency inventory of all systems running affected Coherence versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); implement immediate temporary firewall rules to restrict Coherence network access to authorized sources only; enable enhanced logging on all Coherence instances. Within 7 days: Deploy network segmentation to isolate Coherence infrastructure to dedicated trusted network segments; configure network-based intrusion detection with Coherence-specific signatures; perform forensic log review covering the past 30 days for indicators of unauthorized access. Within 30 days: Continuously monitor Oracle Security Advisories for patch release; conduct prioritized business impact assessment to identify critical Coherence deployments requiring immediate upgrade; develop and test version upgrade procedures for deployment immediately upon patch availability.

Oracle Coherence CVE-2026-60262

EUVD-2026-46677 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-jqpm-rccg-j7vp

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor states easily exploitable, unauthenticated network (TCP) access yielding full product takeover, so AV:N/AC:L/PR:N/UI:N with complete C/I/A impact and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:38 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (Fusion Middleware Core component) allows an unauthenticated network attacker to fully compromise the affected instance over TCP, per Oracle's July 2026 Critical Patch Update. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, all carrying a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the 'easily exploitable / unauthenticated / network' profile makes it a high-priority patch item.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform bundled with Oracle Fusion Middleware, used to scale stateful Java applications through clustered caching, event processing and data partitioning across nodes. The flaw resides in the 'Core' component and is reachable over TCP, consistent with Coherence's cluster and proxy/extend communication services which listen on the network for member and client traffic. Oracle assigns no CWE (CWE: N/A) and does not publish root-cause detail; given a full-takeover impact in a Java middleware data grid reachable pre-authentication, the class most plausibly involves unsafe deserialization or protocol-level handling of untrusted network input, but this is inferred, not confirmed by the vendor.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; Oracle publishes patched builds per affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) through the CPU rather than a single tagged release, so consult the CPU patch matrix for the exact bundle for your version and prioritize this as a critical, unauthenticated-takeover fix. Until patched, reduce exposure by restricting network access to Coherence cluster and Coherence*Extend/proxy listener ports so they are reachable only from trusted application-tier hosts (firewall/segmentation), which prevents untrusted TCP clients from reaching the vulnerable service but can break legitimate remote Extend clients that are not whitelisted. Where Coherence security is supported, enable cluster member authentication/TLS and disable unauthenticated Extend proxy endpoints; note these controls may require configuration changes and client-side updates and are compensating measures only - not a substitute for the CPU patch.