What is the CVSS score of CVE-2026-60281?

CVE-2026-60281 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle Coherence are affected by CVE-2026-60281?

Oracle Coherence (Fusion Middleware Core) contains an unauthenticated remote authentication bypass allowing attackers on the same network segment to read, modify, or delete all cached data without…

How to fix or mitigate CVE-2026-60281?

Within 24 hours: inventory all Oracle Coherence deployments, map which instances store sensitive or regulated data, and assess network topology to identify systems on shared physical segments. Within 7 days: implement network segmentation to isolate Coherence cluster communication (typically port 7574) from untrusted network segments and deploy network intrusion detection signatures specific to Coherence cluster protocols. Within 30 days: establish a patch readiness program by monitoring Oracle's advisory page for CVE-2026-60281 patch release, pre-stage testing environments, and prepare a phased deployment schedule for affected Coherence versions (emphasize instances handling regulated or sensitive data).

Oracle Coherence CVE-2026-60281

EUVD-2026-46696 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-mvh8-8qhc-jw4g

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Adjacent segment access gives AV:A; unauthenticated low-complexity cluster interaction gives PR:N/AC:L; full data read/write yields C:H/I:H, with no availability impact (A:N).

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:30 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Coherence executes to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Coherence accessible data as well as unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Adjacent-network compromise of Oracle Coherence (Oracle Fusion Middleware Core component) lets an unauthenticated attacker on the same physical communication segment read, create, delete, or modify all Coherence-accessible data. Rated CVSS 3.1 8.1, the flaw - tagged as an authentication bypass by the reporter (Oracle) - yields high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis and not listed in CISA KEV; disclosed via the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid used by enterprise Java applications for clustered caching, data partitioning, and low-latency state sharing across nodes. The affected 'Core' component handles the intra-cluster communication and data-management fabric that Coherence members use to join clusters and exchange partitioned data. The CVSS vector's AV:A (Adjacent) and the description's 'access to the physical communication segment' point to a cluster-membership or cluster-protocol trust weakness - consistent with the 'Authentication Bypass' tag - where a rogue participant on the Coherence network segment can interact with cluster data without authenticating. No CWE was assigned by the source, so the precise weakness class (missing authentication / improper access control on the cluster protocol) is inferred from the vector and tags rather than confirmed.

RemediationAI

Patch available per vendor advisory: apply the fixes in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for your Coherence release train (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); the CPU does not publish a single fixed version string in the provided data, so consult the advisory's patch matrix for the exact patch number per version. Because the attack requires Adjacent access, the strongest compensating control until patching is network segmentation: isolate Coherence cluster (TCMP/well-known-address) traffic onto a dedicated, access-controlled VLAN or subnet so untrusted hosts cannot reach the cluster communication segment (trade-off: requires network re-architecture and firewall/ACL changes, and mis-scoping can break legitimate cluster member discovery). Additionally enable Coherence's built-in security features - TLS/SSL for cluster and Extend traffic and cluster member authentication/authorized-hosts filtering - to blunt the authentication-bypass vector (trade-off: added latency and certificate/host-list management overhead).