What is the CVSS score of CVE-2026-60273?

CVE-2026-60273 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Coherence are affected by CVE-2026-60273?

Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are vulnerable to complete remote takeover by unauthenticated attackers, creating immediate risk of data breach and system…

How to fix or mitigate CVE-2026-60273?

Within 24 hours: Inventory all Oracle Coherence deployments and identify systems running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0; prioritize systems in production or storing sensitive data. Within 7 days: Obtain Oracle's July 2026 Critical Patch Update, develop a deployment plan with testing in staging environments, and coordinate maintenance windows with application teams. Within 30 days: Deploy the patch to all affected Coherence instances across all environments, validate system functionality post-patching, and confirm all instances are running supported patched versions.

Oracle Coherence CVE-2026-60273

EUVD-2026-46688 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-gjv2-w2qw-6929

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network TCP reach gives AV:N/PR:N/UI:N; Oracle's difficult-to-exploit qualifier and takeover outcome justify AC:H with full C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:35 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence is possible when a remote, unauthenticated attacker reaches the product over TCP and successfully exploits a hard-to-trigger flaw in the Core component, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 8.1). Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, all addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching/clustering platform bundled with Oracle Fusion Middleware and commonly deployed alongside Oracle WebLogic Server. The flaw resides in the 'Core' component and is reachable over the cluster/proxy TCP protocol used by Coherence nodes and Extend clients. Oracle assigns no CWE (N/A) and tags the issue as Information Disclosure, but the C:H/I:H/A:H impact and 'takeover' language are more consistent with the object-deserialization and remote-invocation weaknesses historically seen in Coherence's TCP-based clustering and Extend/POF serialization paths, where a crafted network payload can be processed by a cluster member without authentication.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), the vendor-released patch covering versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; Oracle does not publish an exact standalone fix build in the provided data, so use the CPU patch mapped to your installed version. Until patched, reduce exposure by restricting network access to Coherence cluster and Extend/proxy TCP ports to trusted management segments via firewall or security-group rules, since Coherence should not be reachable from untrusted networks; be aware this can break legitimate remote Extend clients and cross-datacenter clustering if those flows are not explicitly allowlisted. Where supported, enable Coherence Extend/cluster TLS with identity/authorization filters and constrain deserialization to expected POF types to raise the bar against crafted-payload processing, accepting the configuration and interoperability-testing overhead this introduces.