What is the CVSS score of CVE-2026-60278?

CVE-2026-60278 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60278?

Oracle Coherence (versions 12.2.1.4.0 and 14.1.1.0.0), a critical Oracle Fusion Middleware component, contains a vulnerability enabling unauthenticated attackers to achieve complete system takeover…

How to fix or mitigate CVE-2026-60278?

Within 24 hours: Conduct network asset inventory to identify all Coherence 12.2.1.4.0 and 14.1.1.0.0 instances and assess external reachability via HTTP; flag any internet-facing or cross-network-accessible systems for immediate isolation. Within 7 days: Implement firewall rules and network ACLs restricting HTTP access to these Coherence instances to trusted internal systems only; deploy enhanced logging on all Coherence traffic to establish a baseline for detecting exploitation attempts. Within 30 days: Execute migration plan to move workloads to an unaffected Oracle Coherence version (consult Oracle advisories for available alternatives); for systems with extended migration timelines, deploy inline intrusion prevention or WAF filtering at network boundaries to block malicious payloads targeting this vulnerability.

Oracle Coherence CVE-2026-60278

EUVD-2026-46693 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-vw78-rvpp-xc66

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated remote HTTP exploitation with low complexity (AV:N/AC:L/PR:N/UI:N) and describes full takeover, so C/I/A are all High with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:32 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) versions 12.2.1.4.0 and 14.1.1.0.0 is possible by an unauthenticated attacker sending crafted traffic over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is rated by Oracle as 'easily exploitable,' meaning no special skill or configuration is needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch target.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching/computation platform bundled with Oracle Fusion Middleware, commonly used to scale Java (WebLogic) applications by clustering data across nodes. The vulnerability sits in the 'Core' component and is reachable over HTTP, which points at Coherence's management/extend or REST-facing interfaces rather than internal cluster (TCMP) traffic. Oracle did not assign a CWE (listed N/A), so the precise root-cause class is unconfirmed; however, prior Coherence 'takeover via HTTP' issues have historically stemmed from unsafe deserialization of untrusted data, and the full C/I/A compromise here is consistent with a remote code execution or object-injection class flaw. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence, covering the Coherence application component specifically.

RemediationAI

Apply the patch from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and authoritative fix for the affected 12.2.1.4.0 and 14.1.1.0.0 releases; Oracle distributes these as CPU bundle patches rather than a single renamed version, so identify the exact patch number for your Coherence/WebLogic release in that advisory. Apply patch per vendor advisory as the specific fix; a discrete renamed patched version is not independently confirmed from the input. Until patching is complete, reduce exposure by restricting network access to Coherence HTTP-facing endpoints (management, REST, and Coherence*Extend proxy ports) to trusted management networks via firewall/ACLs, and place any internet-exposed instance behind a reverse proxy or VPN - the trade-off is that legitimate remote management or extend clients on those paths will lose connectivity and must be allow-listed. If unsafe deserialization is the mechanism (unconfirmed, CWE N/A), enforcing Coherence/WebLogic serialization filters (JEP 290 allow-lists) can further limit reachability, at the cost of potentially breaking clients that rely on Java-serialized payloads.