What is the CVSS score of CVE-2026-60280?

CVE-2026-60280 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60280?

Oracle Coherence, a core Oracle Fusion Middleware component, allows unauthenticated attackers to achieve complete remote takeover of affected systems via network access alone, with no user…

How to fix or mitigate CVE-2026-60280?

Within 24 hours: Conduct a comprehensive inventory scan using Nessus, Qualys, or equivalent asset management tools to identify all Oracle Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 instances; classify by network exposure (internet-facing, corporate-network, isolated). Immediately restrict network access to affected instances using firewall rules to allow only essential authorized sources. Within 7 days: Deploy HTTP/2-specific WAF rules to block suspicious connections to identified Coherence systems; segment affected systems into dedicated VLANs where operationally feasible; enable centralized logging and real-time alerting on all HTTP/2 connections to Coherence ports. Within 30 days: Contact Oracle support to confirm availability of patched versions for your Coherence deployments; schedule and execute upgrades to patched versions, prioritizing internet-facing and business-critical systems; complete migration off affected versions or validate Oracle's security fix.

Oracle Coherence CVE-2026-60280

EUVD-2026-46695 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-r692-h44v-fqj7

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network reach over HTTP/2 with no user interaction gives AV:N/AC:L/PR:N/UI:N, and vendor-stated full takeover justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:31 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated attacker with network access via HTTP/2 to fully compromise affected versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw yields complete confidentiality, integrity, and availability loss (CVSS 3.1 base 9.8) and was disclosed by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the network-reachable, no-privilege, no-interaction profile makes it a top-priority patching target.

Technical ContextAI

Oracle Coherence is an in-memory distributed data grid used to cache and manage application state at scale, commonly deployed alongside Oracle WebLogic Server and other Fusion Middleware stacks in enterprise Java environments. The Core component is the foundational clustering and data-management layer, and the vulnerability is reachable over HTTP/2, indicating the exposure is in a network-facing listener/protocol handler rather than an internal cluster-only channel. Oracle assigned no CWE (CWE: N/A) and published no class-level root-cause detail; the combination of full C/I/A impact with unauthenticated network reach is consistent with a deserialization or request-parsing flaw of the type historically seen in Coherence/WebLogic, but the exact weakness class is not confirmed in the available data.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update fixes for Oracle Coherence per https://www.oracle.com/security-alerts/cpujul2026.html; Oracle delivers these as CPU patch bundles rather than a single upstream version tag, so identify and apply the correct patch for your installed 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 release (patch available per vendor advisory; no standalone fixed version string is provided in the input). Until patched, restrict network reachability of the Coherence HTTP/2 listener: block or firewall the affected port from untrusted networks, place the service behind an authenticated reverse proxy or VPN, and limit access to known application-tier hosts only - the trade-off is that legitimate clients or clustered peers relying on that endpoint must be explicitly allow-listed or they will lose connectivity. Because the vector is HTTP/2, disabling or fronting the HTTP/2 endpoint where it is not required also reduces exposure, at the cost of any functionality that depends on it. Do not rely on authentication controls as a mitigation since exploitation requires no privileges.