What is the CVSS score of CVE-2026-60268?

CVE-2026-60268 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60268?

Oracle Coherence, a core enterprise middleware component, contains a critical vulnerability allowing attackers to completely compromise affected systems with minimal network access and low…

How to fix or mitigate CVE-2026-60268?

Within 24 hours, inventory all Oracle Coherence deployments across the enterprise, confirm affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0), and immediately restrict TCP network access to Coherence instances using firewall rules and network segmentation to only explicitly authorized systems. Within 7 days, deploy enhanced monitoring for exploitation attempts, establish elevated change control for Coherence deployments, evaluate temporary workload migration to alternative systems if business continuity risk is unacceptable, and engage Oracle for patch availability timeline. Within 30 days, apply the vendor-released patch immediately upon availability and conduct full vulnerability rescanning across all Coherence instances to confirm remediation.

Oracle Coherence CVE-2026-60268

EUVD-2026-46683 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-vh7c-qc9g-9hvp

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable TCP service (AV:N), Oracle-rated easily exploitable (AC:L), requires existing low-privilege access (PR:L), no user interaction, and full takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:37 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence (Fusion Middleware Core component) is possible by a low-privileged attacker with TCP network access to an affected instance, per Oracle's July 2026 Critical Patch Update. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, carrying a CVSS 3.1 base score of 8.8 with high confidentiality, integrity and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the 'easily exploitable' rating combined with complete-compromise impact makes it a priority patch.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching/clustering platform bundled with Oracle Fusion Middleware, commonly used to scale Java (WebLogic) application state across a cluster. The flaw resides in the Core component and is reachable over TCP, consistent with Coherence's cluster/proxy listeners (e.g., the Coherence*Extend TCP proxy and cluster communication sockets) rather than a purely HTTP surface. Oracle assigns no CWE (listed N/A) and, per standard CPU practice, does not disclose root-cause internals; the 'Information Disclosure' tag alongside the C:H/I:H/A:H vector and explicit 'takeover' language points toward a deserialization- or protocol-handling weakness in a network-facing Java service - the classic bug class for Coherence and similar middleware - though this specific root cause is not confirmed in the available data.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though Oracle publishes patch bundle/interim-patch identifiers per version rather than a single tagged release, so select the CPU patch matching your exact Coherence version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0). Until patched, reduce exposure by restricting network access to Coherence cluster and Coherence*Extend TCP proxy ports so they are reachable only from trusted application tiers (firewall and segment the grid; do not expose proxy ports to untrusted networks or the internet), enable and require TLS/SSL plus authentication on Coherence*Extend and cluster sockets if not already enforced, and tighten or revoke any low-privilege accounts that can reach these services since the vector requires only PR:L. Note that locking down proxy ports or enforcing TLS/auth can break clients that currently connect anonymously or in cleartext, so validate cluster connectivity after applying these controls.