What is the CVSS score of CVE-2026-60275?

CVE-2026-60275 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60275?

CVE-2026-60275 in Oracle Coherence (Oracle Fusion Middleware) allows unauthenticated remote attackers to achieve full system compromise with CVSS 9.8, affecting confidentiality, integrity, and…

How to fix or mitigate CVE-2026-60275?

Within 24 hours, identify all Oracle Fusion Middleware instances across the enterprise running affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, document business purpose and criticality, and implement emergency network access restrictions to isolate these systems from untrusted networks if operationally feasible. By day 7, deploy compensating controls including network segmentation to restrict Coherence HTTP access to trusted IP ranges, implement WAF rules to block suspicious traffic, enable enhanced logging and real-time alerting on these instances, and assess which instances can be safely disabled. Within 30 days, establish continuous monitoring of Oracle security advisories and patch releases, engage stakeholders to define remediation strategy (upgrade paths or architectural alternatives), and perform regular security assessments of deployed mitigations.

Oracle Coherence CVE-2026-60275

EUVD-2026-46690 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-293q-5pc2-p657

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easy unauthenticated HTTP exploitation resulting in full takeover, supporting AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:34 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware allows an unauthenticated attacker to remotely compromise affected instances over HTTP, impacting confidentiality, integrity, and availability. Oracle rates this CVSS 9.8 and describes it as easily exploitable against supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and absence of any authentication requirement make it a top-tier patching priority.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching/clustering platform bundled with Oracle Fusion Middleware, widely used to scale WebLogic and other Java EE application tiers. The flaw resides in the Coherence Core component and is reachable over HTTP by an unauthenticated network client, consistent with the historical pattern of Coherence/WebLogic vulnerabilities rooted in unsafe deserialization of untrusted Java objects exposed over HTTP/extend/T3 endpoints leading to remote code execution. Oracle assigns no CWE (CWE: N/A), so the precise root-cause class is not confirmed in the provided data; the CPE cpe:2.3:a:oracle_corporation:oracle_coherence identifies the affected product but its wildcarded version field does not enumerate exact affected ranges.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though an exact fixed build number is not enumerated in the provided data, so map each affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) to its corresponding CPU patch or bundle in that advisory. Until patching completes, reduce exposure by restricting network reachability of Coherence HTTP and cluster ports to trusted management networks only and placing the tier behind a firewall or reverse proxy that blocks untrusted access, since the vulnerability requires only network access - note this can break legitimate client, extend, and cluster connectivity, so validate application traffic paths before applying. Where Coherence uses Java serialization over its extend/HTTP endpoints, enforce or tighten serialization allowlists/filters as a compensating control, accepting that overly strict filters may reject legitimate object types and require tuning.