What is the CVSS score of CVE-2026-60274?

CVE-2026-60274 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60274?

A critical vulnerability in Oracle Coherence versions 12.2.1 through 15.1.1 enables complete unauthorized system compromise via remote network access without authentication, affecting any…

How to fix or mitigate CVE-2026-60274?

Within 24 hours, conduct a complete inventory of all Oracle Coherence deployments and identify which systems run versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0, documenting their network accessibility and business criticality. Within 7 days, implement network segmentation to restrict unauthenticated TCP access to affected Coherence instances through firewall rules and access control lists; prioritize moving production systems to isolated network segments and enable enhanced logging for all remote connection attempts. Within 30 days, establish an expedited patch deployment plan by monitoring Oracle Security Advisories for vendor patches, committing to immediate deployment of patches upon release to all affected versions, or if patches remain unavailable, execute contingency plans for architectural migration or complete production isolation of vulnerable systems.

Oracle Coherence CVE-2026-60274

EUVD-2026-46689 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-g2xg-4994-m5w6

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated network exploitation over TCP with low complexity and full takeover, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; scope unchanged as impact stays within the Coherence process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:34 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible for a remote unauthenticated attacker who can reach the product over TCP, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) reflects that no authentication or user interaction is required and that a successful attack fully compromises confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but Oracle rates it 'easily exploitable,' making it a high-priority patch in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Coherence is a distributed, in-memory data grid used to cache and share application state across clustered JVMs, commonly deployed alongside Oracle WebLogic Server and other Fusion Middleware components. The affected component is 'Core,' and cluster/client communication occurs over TCP via the Coherence cluster protocol (TCMP) and Coherence*Extend proxy services, both of which historically process serialized Java objects. Oracle does not assign a CWE for this issue, but the combination of an unauthenticated TCP attack vector and full 'takeover' impact is consistent with the unsafe-deserialization class of flaws (CWE-502) that has affected prior Coherence and WebLogic advisories; this cannot be confirmed from the supplied data alone. The single CPE string cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:* covers the product with no version bound, so the enumerated affected versions come from the advisory text rather than the CPE.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor advisory covering this CVE; patch available per vendor advisory, with the exact patched build corresponding to each affected line (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) listed in that CPU. Because exploitation is over TCP from the network, restrict network reachability of Coherence cluster (TCMP) and Coherence*Extend proxy ports to trusted hosts only via firewall/segmentation until patching is complete - the trade-off is that overly tight rules can break legitimate cluster membership or Extend clients, so scope the allow-list to known cluster/application nodes. Where supported, enable TLS/SSL and authentication on Coherence*Extend and cluster transport to reduce exposure of the unauthenticated TCP surface, accepting the added configuration and performance overhead. Do not expose Coherence ports to untrusted or internet-facing networks.