What is the CVSS score of CVE-2026-60266?

CVE-2026-60266 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Coherence CVE-2026-60266

EUVD-2026-46681 MEDIUM

Information Exposure (CWE-200)

2026-07-21 oracle

GHSA-q777-696q-j9pq

Authentication Bypass Information Disclosure Oracle Oracle Coherence Oracle Corporation

5.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Network TLS vector, no credentials required, but AC:H for required exploit conditions; impact is confidentiality-only with no integrity or availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:11 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthenticated confidentiality breach in Oracle Coherence's Core component exposes complete cached data over TLS to network attackers across all current supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). The flaw is tagged as an Authentication Bypass, allowing a remote unauthenticated attacker reachable via TLS to read all data accessible within the Coherence grid - including potentially sensitive application state, session data, and business records. No active exploitation is confirmed (not in CISA KEV) and no public exploit code exists at time of analysis; however, the PR:N/UI:N profile combined with complete confidentiality loss makes this a material concern for enterprises running exposed Coherence clusters.

Technical ContextAI

Oracle Coherence is an enterprise-grade distributed in-memory data grid (IMDG) and caching platform, part of Oracle Fusion Middleware, commonly used in high-throughput Java EE and microservices architectures. Clusters communicate over proprietary protocols typically secured via TLS. The vulnerability resides in the Core component - the central subsystem managing cluster membership, data partitioning, and inter-node communication. The 'Authentication Bypass' tag indicates the flaw likely involves improper validation of peer identity or session credentials during TLS handshake or subsequent protocol exchange. No CWE has been assigned, which prevents precise root-cause classification, but an authentication bypass in a TLS-secured distributed system typically points to incomplete trust anchor validation, improper certificate chain verification, or a logic flaw in protocol state machine identity checks. CPE cpe:2.3:a:oracle_corporation:oracle_coherence covers all four affected branches.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update as described at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle CPUs typically include patched binaries for all listed versions, though exact patched version numbers beyond the CPU quarter designation are not independently confirmed in available data. As compensating controls for environments that cannot immediately patch: restrict firewall access to Coherence cluster communication ports (default TCP 7574 and related ports) to only trusted internal hosts and application servers, eliminating untrusted network reach to the TLS endpoint; this directly addresses the AV:N attack vector. Additionally, enforce TLS mutual authentication (mTLS) at the cluster level if not already configured - requiring client certificates from connecting nodes limits the PR:N exposure, though whether this fully mitigates the underlying auth bypass flaw depends on the specific defect root cause, which has not been publicly disclosed. Note that overly restrictive mTLS may impact legitimate cluster expansion and must be tested. Do not disable TLS transport, as this would remove the existing security layer without addressing the flaw.