What is the CVSS score of CVE-2026-60263?

CVE-2026-60263 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60263?

Oracle Coherence, a core data caching component in Oracle Fusion Middleware, is vulnerable to unauthenticated remote data disclosure affecting versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

How to fix or mitigate CVE-2026-60263?

Within 24 hours, identify all systems running Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and immediately restrict network access to Coherence ports through firewall rules and network segmentation to trusted networks only. Within 7 days, deploy enhanced monitoring and logging on all Coherence cluster access, document the complete inventory of vulnerable systems, and assess the data sensitivity of each affected cluster. Within 30 days, evaluate upgrade paths to newer Coherence versions (14.1.3 or later, when available), implement VPN-only access policies for administrative and application connectivity, consider air-gapping or isolating non-critical Coherence deployments, and establish a process to monitor Oracle security advisories for patch availability.

Oracle Coherence CVE-2026-60263

EUVD-2026-46678 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-p2v2-x499-54p9

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated low-complexity TCP access (AV:N/AC:L/PR:N/UI:N) yields full data read but no write or disruption, so C:H with I:N/A:N and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:38 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthenticated data disclosure in Oracle Coherence (Oracle Fusion Middleware, Core component) versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 lets a remote attacker with only TCP network access read or fully access all Coherence-managed data. Oracle rates it CVSS 3.1 7.5 with confidentiality-only impact and classifies it as easily exploitable; the 'Authentication Bypass' tag indicates the flaw circumvents access controls to expose cluster data. No public exploit identified at time of analysis, and no EPSS or CISA KEV signal is present in the provided data.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid used within Oracle Fusion Middleware to cache and share application state across clustered JVM nodes, typically communicating over its own TCP-based cluster and proxy protocols (TCMP and Coherence*Extend). The affected 'Core' component provides the fundamental cluster and data-access services, so a weakness here exposes stored grid data directly. No CWE was assigned in the source data, but the vendor's 'Authentication Bypass' tag combined with the confidentiality-only, network-reachable profile points to a broken or missing authentication/authorization control on a network-exposed Coherence service (a CWE-287/CWE-306 class root cause) allowing data reads without valid credentials. The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence:*.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle July 2026 Critical Patch Update for Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle strongly recommends applying CPU patches without delay and does not ship standalone hotfixes outside the CPU. Until patching completes, reduce exposure by restricting network access to Coherence cluster and proxy/*Extend TCP ports so only trusted application hosts can reach them via firewall or security-group allowlisting, and place Coherence clusters on isolated management networks rather than any internet-facing or broadly shared segment - the trade-off is that overly tight rules can break legitimate cluster membership or client tiers, so validate that all authorized nodes and Coherence*Extend clients remain reachable. Where supported, enable Coherence authentication/authorization and TLS on cluster and extend endpoints to limit unauthenticated data access, accepting the added configuration and performance overhead.