What is the CVSS score of CVE-2026-60269?

CVE-2026-60269 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60269?

Oracle Coherence, a core component of Oracle Fusion Middleware, is vulnerable to unauthenticated remote takeover (CVE-2026-60269, CVSS 9.8) that permits complete compromise of the in-memory data grid…

How to fix or mitigate CVE-2026-60269?

Within 24 hours: identify and inventory all Oracle Coherence deployments, assess network exposure including internet-facing instances, and activate incident response protocols. Within 7 days: contact your Oracle support account for patch timeline and private access; implement temporary firewall segmentation restricting Coherence cluster ports to trusted internal networks only, and activate monitoring on Coherence protocol traffic for intrusion detection. Within 30 days: apply the vendor patch upon release, conduct regression testing across dependent applications, and perform security re-scanning to confirm remediation.

Oracle Coherence CVE-2026-60269

EUVD-2026-46684 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-7qw5-jfjw-g9gv

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated TCP network access and easy exploitability yielding full takeover, so AV:N/AC:L/PR:N/UI:N with high C/I/A.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:36 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (Core component) allows an unauthenticated attacker with TCP network access to fully compromise the in-memory data grid, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no required privileges or user interaction. No public exploit identified at time of analysis, but the trivial exploitability and full-takeover impact make this a high-priority patch for affected Fusion Middleware deployments.

Technical ContextAI

Oracle Coherence is a distributed, in-memory data grid used within Oracle Fusion Middleware (frequently alongside WebLogic Server) to provide clustered caching, data partitioning, and low-latency access for enterprise Java applications. Cluster members communicate over TCP, and external clients connect through the Coherence*Extend/proxy tier, which is the network surface referenced by the AV:N vector. Oracle classifies the defect in the 'Core' component and did not assign a CWE (CWE: N/A); the 'takeover of Oracle Coherence' language combined with full C/I/A impact is consistent with an unauthenticated deserialization or protocol-handling flaw in the cluster/proxy communication path, a recurring root-cause class in Java middleware, though Oracle does not disclose the precise mechanism. The single reported CPE, cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:*, is version-agnostic (wildcard) and does not by itself pin the affected releases - those come from the advisory text.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - Patch available per vendor advisory; Oracle does not publish a separate semantic fix build number, so consult the CPU patch matrix for the exact Coherence bundle patch for your release. Until patched, reduce exposure by restricting network reachability of the Coherence cluster and Coherence*Extend/proxy TCP ports to trusted hosts via firewall or network segmentation, and avoid exposing proxy listeners to untrusted or internet-facing networks; the trade-off is that overly tight filtering can break legitimate cluster membership or remote client connectivity, so validate the cluster port list before applying rules. Where Coherence*Extend proxies are not required, disable the external proxy tier to shrink the attack surface, accepting that remote non-cluster clients will lose access.