What is the CVSS score of CVE-2026-60267?

CVE-2026-60267 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60267?

Oracle Coherence, a core data caching component in Oracle Fusion Middleware, contains a critical authentication bypass vulnerability (CVSS 9.1) that exposes an organization's cached data to remote…

How to fix or mitigate CVE-2026-60267?

Within 24 hours, conduct an inventory of all systems running Oracle Coherence, identify which versions are deployed, and map the scope of sensitive data stored (session data, credentials, customer records, configuration). Within 7 days, implement network-layer compensating controls by restricting Coherence TLS connectivity to trusted internal networks only via firewall or network segmentation, disable any external or untrusted access paths, and enable comprehensive audit logging and real-time alerting on all Coherence API calls. Within 30 days, establish direct communication with Oracle support to track patch availability, develop and test an upgrade or system migration plan, conduct forensic analysis of all historical access logs for signs of unauthorized access or data modification, and document findings in an incident report for stakeholders.

Oracle Coherence CVE-2026-60267

EUVD-2026-46682 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-xrh4-w2q7-7hwc

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Network-reachable authentication bypass with no privileges or interaction (AV:N/AC:L/PR:N/UI:N) yields full data read and tamper (C:H/I:H) but no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:36 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Coherence accessible data as well as unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Coherence (Oracle Fusion Middleware Core component) lets an unauthenticated attacker with network access via TLS read, create, delete, or modify all Coherence-accessible data. Oracle rates it 9.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and the intelligence tags flag it as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform embedded across Oracle Fusion Middleware and WebLogic-based deployments, used to store and cluster application state and 'critical data' across nodes. The flaw sits in the Core component and, per the supplied tags, behaves as an authentication bypass: an attacker reaching the Coherence service over TLS is granted read/write access to grid data without valid credentials. No CWE was assigned in the source data, but the Authentication Bypass tag places the root cause in the CWE-287/CWE-306 (improper/missing authentication) class rather than a memory-safety or injection bug. The CPE cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:* covers the Coherence product generically without version pinning in the CPE itself.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for your Coherence release train - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0; Oracle does not publish a single standalone fixed version number in the supplied data, so use the CPU-mapped patch for your installed version (Patch available per vendor advisory - exact fixed build to be taken from the CPU patch matrix). Until patched, reduce exposure by restricting network access to Coherence cluster and management/extend (TCP proxy) ports to trusted hosts only via firewall/security-group rules, and ensure Coherence is not reachable from untrusted or internet-facing networks; where supported, enforce TLS mutual authentication and Coherence security (identity/authorization, e.g. the security-framework and client authentication) on Extend and cluster communication. The trade-off is that tightening authentication and locking down ports can break legitimate clients or cross-datacenter clustering, so stage the changes and validate client connectivity before enforcing broadly.