What is the CVSS score of CVE-2026-60277?

CVE-2026-60277 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Coherence are affected by CVE-2026-60277?

A high-severity remote code execution vulnerability (CVE-2026-60277) in Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 enables unauthenticated remote attackers to achieve…

How to fix or mitigate CVE-2026-60277?

Within 24 hours, identify all systems running vulnerable Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and map internet-facing or untrusted network access points. Within 7 days, implement immediate network isolation by restricting Coherence port access (primarily TCP 7574) to authorized internal systems only, disabling unnecessary services on non-critical instances, and enabling comprehensive logging of all connection attempts to vulnerable systems. Within 30 days, execute full remediation by upgrading all affected Coherence installations to current patched versions or replacing with alternative solutions; validate isolation controls are effective before decommissioning any compensating measures.

Oracle Coherence CVE-2026-60277

EUVD-2026-46692 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-q48f-fv3q-5r34

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network TCP reach (AV:N/PR:N/UI:N) with Oracle-rated difficult conditions (AC:H) yielding full takeover, so C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:33 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw affects the Core component across Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and yields complete loss of confidentiality, integrity and availability (CVSS 3.1 8.1). Exploitation is rated high-complexity, and no public exploit has been identified at time of analysis.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid used within Oracle Fusion Middleware to provide clustered caching, session replication and low-latency data access for enterprise Java/WebLogic applications. The affected 'Core' component handles cluster membership and inter-node data operations over TCP (Coherence TCMP cluster traffic and Extend proxy connections), which is the network surface reachable by the attacker. Oracle assigns no CWE (N/A) for this entry, but historic Coherence 'Core' takeover flaws of this shape have stemmed from unsafe deserialization of untrusted cluster or proxy traffic, which is consistent with an unauthenticated network attacker achieving code-execution-level 'takeover'; this root-cause class is inferred, not confirmed by Oracle.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html) for your Coherence train - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0; Oracle advises applying CPU patches without delay since it does not test or support unpatched configurations. No standalone fix build number is published outside the CPU patch identifiers, so obtain the specific patch ID for your version directly from the advisory rather than assuming a version string. Until patched, reduce the network attack surface: restrict Coherence cluster (TCMP) and Extend proxy TCP ports to trusted hosts via firewall/security-group rules and network segmentation, and never expose Coherence proxy listeners to untrusted networks or the internet; where feasible enable TLS/SSL and identity/authorization on Coherence Extend proxies and cluster socket providers. Note these controls add operational overhead and enabling proxy authentication may require client-side configuration changes that break existing unauthenticated clients.