What is the CVSS score of CVE-2026-60276?

CVE-2026-60276 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60276?

Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are subject to unauthenticated remote complete system takeover (CVSS 9.8), enabling attackers to compromise data…

How to fix or mitigate CVE-2026-60276?

Within 24 hours: Identify all systems running affected Oracle Coherence versions and map their network accessibility, particularly exposure of the Core component over HTTPS to untrusted networks. Within 7 days: Implement firewall rules to restrict access to the Coherence Core component to only known, authorized internal networks; enable comprehensive logging and alerting for any connection attempts to the Core component; and document current network-accessible Coherence deployments for risk assessment. Within 30 days: Establish a patch readiness plan including testing procedures, deployment windows, and rollback procedures; subscribe to Oracle security bulletins for patch availability; and evaluate temporary migration of non-critical workloads away from affected Coherence versions if operational risk tolerance permits.

Oracle Coherence CVE-2026-60276

EUVD-2026-46691 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-gh3r-pg2q-qmh2

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated network HTTPS access with easy exploitation and full takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:32 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Coherence is possible when an unauthenticated remote attacker reaches the Core component over HTTPS, per Oracle's July 2026 Critical Patch Update. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and the CVSS 3.1 base score of 9.8 reflects full confidentiality, integrity, and availability compromise with no privileges or user interaction. No public exploit identified at time of analysis, but the low attack complexity and 'easily exploitable' framing from Oracle make this a high-priority patch.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching/clustering platform bundled with Oracle Fusion Middleware, frequently embedded behind WebLogic Server to provide scalable session and application state management. The flaw resides in the Core component and is reachable via HTTPS network access, indicating exposure through a management or cluster communication interface. Oracle assigned no CWE (CWE: N/A) and the 'takeover' impact combined with the Information Disclosure tag is consistent with the deserialization/injection class of weaknesses historically seen in Coherence and WebLogic; however, the exact root cause is not disclosed in the available data and cannot be confirmed. The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence, with version detail carried in Oracle's advisory rather than the CPE wildcard.

RemediationAI

Patch available per vendor advisory: apply the Oracle July 2026 Critical Patch Update fixes for Oracle Coherence corresponding to your installed version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0), following https://www.oracle.com/security-alerts/cpujul2026.html; Oracle publishes the exact patch numbers per release in that advisory rather than a single fix version. Because Oracle strongly recommends applying CPU patches without delay, prioritize this for any Coherence instance reachable over the network. Until patching is complete, reduce exposure by restricting network access to Coherence cluster and management ports so only trusted application hosts can reach them (firewall/segmentation), placing Coherence on an isolated back-end network segment, and terminating or restricting the HTTPS interface used for the affected Core communication - noting the trade-off that overly tight segmentation can disrupt legitimate cluster member communication and management tooling, so validate member connectivity after any network changes.