What is the CVSS score of CVE-2026-60264?

CVE-2026-60264 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-60264?

Within 24 hours, execute inventory of all systems running Oracle Coherence 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and map their network exposure; implement firewall rules immediately restricting HTTP/2 access to these instances to only approved internal systems. Within 7 days, enforce network segmentation isolating data-grid instances from untrusted networks, disable HTTP/2 protocol if business requirements permit, and establish detailed asset tracking for all affected Coherence deployments. Within 30 days, continuously monitor Oracle security advisories for patch availability, conduct testing of upgrade paths to patched or newer unaffected versions, and develop a prioritized remediation plan focusing first on instances handling sensitive data.

Oracle Coherence CVE-2026-60264

EUVD-2026-46679 CRITICAL

Information Exposure (CWE-200)

2026-07-21 oracle

GHSA-gff8-6vmp-57qh

Information Disclosure Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach Coherence HTTP/2 listener
Delivery

Send crafted HTTP/2 request to Core
Exploit

Trigger unauthenticated flaw
Execution

Achieve instance takeover
Impact

Access grid data and disrupt service

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The attacker needs network reachability to the Oracle Coherence Core component over its HTTP/2 listener; per CVSS AV:N/AC:L/PR:N/UI:N there is no special configuration, authentication, or user interaction required beyond that reachability. In effect: no special conditions - remote unauthenticated exploitation against supported/reachable deployments of Oracle Coherence 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The main limiting factor is exposure of the HTTP/2 interface: instances whose Coherence network endpoints are confined to isolated internal/management networks are not reachable by external attackers, which materially reduces real-world risk despite the 9.8 score.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is the worst-practical profile: remote, low-complexity, unauthenticated, no user interaction, with full confidentiality/integrity/availability loss. Oracle itself describes it as 'easily exploitable', consistent with AC:L. Countervailing signals: no EPSS score was provided, there is no public exploit identified at time of analysis, and it is not in CISA KEV - so there is currently no evidence of active or automated exploitation. This is therefore a genuinely high-priority issue on intrinsic exploitability grounds (network + unauthenticated + full impact), not a 'high-CVSS-but-low-real-risk' case, even though weaponization data is unavailable. Note a conflict: the input tags this 'Information Disclosure' while the description and vector assert full C/I/A takeover - treat the takeover characterization as authoritative and the tag as an undercount; verify scope with Oracle's advisory.
Exploit ScenarioDerived	An attacker who can reach the Coherence HTTP/2 port sends a crafted request to the Core component and, without any credentials or user interaction, gains control over the Coherence instance, obtaining the ability to read or manipulate cached/grid data and disrupt the service. Because complexity is low and no authentication is needed, the attack is scriptable against any exposed instance, though no public exploit code has been identified at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 21, 2026

Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) lets an unauthenticated attacker with only HTTP/2 network reachability fully compromise the affected data-grid instance. Supported versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity and availability impact. No public exploit has been identified at time of analysis and it is not in CISA KEV, but the easily exploitable, network-facing, unauthenticated nature makes this a top-priority patch.

RemediationAI

Patch available per vendor advisory: apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to Oracle Coherence 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; consult that CPU for the exact patched build for your version, as no standalone fix version number is present in the source data. Until patching is complete, reduce exposure by restricting network access to the Coherence HTTP/2 listener so it is reachable only from trusted management/application subnets via network ACLs, firewall rules, or segmentation, and disable or firewall any Coherence HTTP/REST or Extend endpoints that are not required - with the trade-off that legitimate remote management or cross-tier clients relying on those endpoints will lose connectivity and must be re-scoped to the allowed networks. Because the flaw is unauthenticated, application-layer authentication cannot be relied on as a compensating control, so network isolation is the primary interim mitigation.

Affected VersionsENISA

Oracle Coherence 14.1.1.0.0

Oracle Coherence 14.1.2.0.0

Oracle Coherence 15.1.1.0.0

Affected Packages

euvd oracle_coherence no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle Coherence is Oracle's in-memory distributed data-grid / caching platform, part of the Oracle Fusion Middleware stack and frequently deployed alongside Oracle WebLogic Server for clustered, low-latency Java applications. The affected 'Core' component is reachable over HTTP/2, indicating the exposure lies in Coherence's network listener/protocol handling path rather than an application layer above it. No CWE was assigned in the source data, so the precise root-cause class is unconfirmed; however, unauthenticated 'takeover' over HTTP in a Java middleware product of this type is most commonly associated with unsafe deserialization or request-parsing flaws. The single affected CPE (cpe:2.3:a:oracle_corporation:oracle_coherence) confirms Oracle Coherence as the sole product in scope.

Know when Oracle Coherence gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Vendor states easily exploitable, unauthenticated, network HTTP/2 access resulting in takeover, so AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H; scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle Coherence in versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contains a CVSS 9.8 remote takeover vulnerability enabling unauthenticated attackers to achieve full compromise of affected data-grid instances. With no public exploit identified at time of analysis and no vendor patch currently available, organizations using these versions face critical data risk requiring immediate access controls. This network-facing, easily exploitable vulnerability puts any exposed Coherence instance at severe risk of data theft and system compromise.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: restrict network access via firewall rules and network segmentation (permit HTTP/2 traffic only from trusted, internal systems); consider disabling HTTP/2 protocol if business operations allow; implement enhanced auditing and monitoring of data-grid access patterns; isolate or air-gap critical data-grid instances from external or untrusted network segments pending patch availability; establish a rapid-response plan for patch deployment upon vendor release.

Threat Intelligence Overview

EPSS Score

0.4%

Top 72% exploitable

Prevalence

Medium

enterprise Java data-grid, common in WebLogic/Fusion Middleware shops, not universal

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.