What is the CVSS score of CVE-2026-60265?

CVE-2026-60265 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle Coherence CVE-2026-60265

EUVD-2026-46680 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-m93v-rp7g-7mm4

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

6.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.0 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.0 MEDIUM

Local vector and high privileges confirmed by description requiring infrastructure logon with elevated account; scope change retained as Oracle explicitly states impact on additional products; no integrity or availability impact described.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:11 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Coherence executes to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Oracle Coherence Core in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 exposes a confidentiality flaw that allows a high-privileged local attacker to gain complete unauthorized read access to all data accessible by the Coherence service, with scope change potential extending that breach to additional Oracle Fusion Middleware products sharing the same infrastructure. The CVSS scope change metric (S:C) is the most operationally significant signal here - exploitation is not contained within Oracle Coherence and may expose data in adjacent Oracle products. No public exploit code and no CISA KEV listing exist at time of analysis, and the local attack vector with high-privilege prerequisite significantly constrains real-world exploitability to insider threat or post-compromise scenarios.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching solution that is part of the Oracle Fusion Middleware stack, used primarily to accelerate data access in large-scale Oracle enterprise deployments. The affected component is Core, the foundational layer responsible for data storage, distribution, and potentially access control enforcement within the Coherence cluster. The CPE string (cpe:2.3:a:oracle_corporation:oracle_coherence) confirms this is the Oracle Corporation's product line across four distinct release trains: 12.2.1.4.x (legacy), 14.1.1.0.x, 14.1.2.0.x, and the current 15.1.1.0.0. The vulnerability is tagged 'Authentication Bypass' by the reporting intelligence source, which - despite the PR:H requirement - suggests the flaw allows the high-privileged attacker to circumvent access controls within the Core component to read data the attacker should not be authorized to access, possibly crossing trust boundaries into co-deployed Oracle middleware products. CWE is not assigned by Oracle, leaving the precise root cause class unspecified in the available data.

RemediationAI

Apply the patches released by Oracle in the July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publicly disclose exact patched version numbers outside the CPU patch matrix, so consult the Oracle patch advisory directly to obtain the correct patch for each affected release train (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). Patch available per vendor advisory - exact patched version strings are not independently confirmed from the available intelligence data. As a compensating control prior to patching, restrict the set of accounts with high-privilege access to the Coherence infrastructure host to only operationally necessary identities, reducing the attack surface to the fewest possible actors; note this does not eliminate the vulnerability but limits who can trigger it. Additionally, review and enforce OS-level access controls on infrastructure nodes running Coherence to prevent unauthorized local logons.