What is the CVSS score of CVE-2026-60279?

CVE-2026-60279 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60279?

Oracle Coherence, a foundational component of Oracle Fusion Middleware used throughout enterprise infrastructure, is vulnerable to unauthenticated remote takeover that grants complete system…

How to fix or mitigate CVE-2026-60279?

Within 24 hours, inventory all Oracle Coherence deployments to identify instances running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and document network exposure for each. Within 7 days, implement network segmentation and firewall rules to restrict HTTP traffic to Coherence clusters to only authorized internal systems; disable HTTP ports where operationally feasible and shift to authenticated access where architecture permits. Within 30 days, establish close coordination with Oracle to track patch release timelines, deploy network intrusion detection signatures to identify exploitation attempts, conduct detailed forensic readiness assessments, and develop a prioritized upgrade or architectural remediation plan.

Oracle Coherence CVE-2026-60279

EUVD-2026-46694 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-gjvx-6cp9-2vpm

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor confirms unauthenticated HTTP-reachable, easily exploitable takeover, so AV:N/AC:L/PR:N/UI:N with full C/I/A high impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:31 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote unauthenticated takeover in Oracle Coherence (Oracle Fusion Middleware, Core component) allows an attacker with only HTTP network access to fully compromise the product across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates this 9.8 (Critical) with full confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning no authentication, credentials, or user interaction are needed. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated network reach and complete compromise makes this a high-priority patch item.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching/clustering platform bundled within Oracle Fusion Middleware, commonly used to scale Java (WebLogic) application state across a cluster. The flaw resides in the Core component and is reachable over HTTP, indicating exposure through Coherence's networked clustering/management or REST/HTTP-facing interfaces rather than a local console. Oracle did not assign a CWE (listed as N/A), so the precise root-cause class is unconfirmed; the 'takeover' outcome combined with Coherence's history of Java-based deserialization/injection issues is consistent with an unsafe-deserialization or remote-code-execution style weakness, but this specific mechanism is not stated in the provided data. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence, and the vendor tag references 'Information Disclosure' though the CVSS reflects far broader impact than disclosure alone.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update as the primary remediation; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch bundle mapped to each affected release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0), as Oracle CPU patches are cumulative and version-specific - Patch available per vendor advisory, with no standalone fixed build number provided in this input. Until patched, restrict network reachability of Coherence's HTTP/cluster interfaces by placing them behind firewalls or internal-only segments and blocking untrusted access to Coherence management and cluster ports, accepting that overly aggressive port restrictions can disrupt legitimate cluster communication and must be validated in a test environment. Where Coherence exposes HTTP/REST management endpoints that are not required, disable them or bind them to loopback/internal interfaces to shrink the unauthenticated attack surface. Ensure Coherence is never directly internet-exposed and monitor for anomalous HTTP requests to Coherence endpoints as a detective control.