What is the CVSS score of CVE-2026-60272?

CVE-2026-60272 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60272?

Oracle Coherence, a mission-critical in-memory data grid component embedded in Oracle Fusion Middleware deployments across the organization, faces a critical unpatched vulnerability enabling complete…

How to fix or mitigate CVE-2026-60272?

Within 24 hours: conduct rapid inventory of all Oracle Coherence deployments across the infrastructure, identify and isolate any internet-exposed instances, and implement restrictive firewall rules limiting HTTP/HTTPS access to Coherence ports to only authorized internal networks. Within 7 days: deploy comprehensive network segmentation isolating Coherence instances from untrusted segments, establish enhanced logging and continuous monitoring for anomalous access patterns, and brief executive leadership on the unpatched critical risk and mitigation timeline. Within 30 days: monitor Oracle's security advisories daily for patch release, develop and test deployment procedures for immediate patch application upon availability, and conduct post-patch validation across all Coherence instances.

Oracle Coherence CVE-2026-60272

EUVD-2026-46687 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-w3fv-cv8v-hh87

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms remote, unauthenticated, low-complexity HTTP exploitation yielding full product takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:35 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware (Core component), is possible by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 and Oracle describes it as easily exploitable, allowing complete takeover with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.

Technical ContextAI

Oracle Coherence is an in-memory distributed data grid / caching platform used to scale stateful applications across clustered nodes, frequently embedded in Oracle WebLogic Server and broader Fusion Middleware deployments. The vulnerability resides in the Core component and is reachable over HTTP, which is consistent with Coherence's management, Extend/proxy, or REST interfaces that can be network-exposed. No CWE was assigned in the source data, so the precise root cause class (e.g., deserialization of untrusted data, a common pattern in Java middleware takeover bugs) cannot be confirmed from the provided intelligence; the single CPE 'cpe:2.3:a:oracle_corporation:oracle_coherence' confirms the affected product is the Coherence application itself across the listed versions.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cpujul2026.html; the input does not specify an exact patched build number, so treat the remediation as 'Patch available per vendor advisory' and pull the specific Coherence patch that corresponds to your installed version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0) from My Oracle Support. Until patched, reduce exposure by restricting network access to Coherence HTTP-facing interfaces (management/REST/Extend proxy ports) to trusted management subnets via firewall or network ACLs, and avoid exposing Coherence directly to the internet - the trade-off is that legitimate remote management and cross-datacenter cluster traffic must be re-scoped to the allowlisted paths. Where Coherence REST or management HTTP endpoints are not required, disable them to remove the attack surface, accepting the loss of those management/monitoring capabilities.