What is the CVSS score of CVE-2026-60282?

CVE-2026-60282 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Coherence CVE-2026-60282

EUVD-2026-46697 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-vpxv-v27g-8mf4

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network TCP access confirmed, easily exploitable per Oracle, low-privileged credential required (PR:L), no availability impact stated in description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:10 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Coherence accessible data as well as unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle Coherence allows a low-privileged, network-adjacent attacker to read, insert, update, or delete data within the Coherence data grid via TCP. Affected versions span the current supported lifecycle: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Despite a moderate CVSS score of 5.4, the 'easily exploitable' descriptor and Authentication Bypass tag suggest the barrier to exploitation is low once an attacker holds any valid low-privileged credential or session token - making this a meaningful data integrity and confidentiality risk in multi-tenant or externally-accessible Coherence deployments. No public exploit code or CISA KEV listing identified at time of analysis.

Technical ContextAI

Oracle Coherence is a distributed, in-memory data grid and caching layer within Oracle Fusion Middleware, commonly deployed in high-availability Java EE environments to manage shared application state and session data at scale. It communicates natively over TCP using proprietary clustering protocols. The CPE string (cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:*) covers multiple major release lines. No CWE was assigned by Oracle, which is consistent with Oracle's CPU disclosure practices, but the 'Authentication Bypass' tag implies a failure in authorization or access control logic within the Core component - potentially allowing a low-privileged principal to issue operations (reads, writes, deletes) against data partitions it should not have access to. The root cause class likely falls under CWE-284 (Improper Access Control) or CWE-863 (Incorrect Authorization), though this is inferred from the symptom description and cannot be confirmed from available data.

RemediationAI

Apply the patches released as part of the Oracle Critical Patch Update July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publicly disclose exact patched version strings within CPU advisories, so administrators should consult My Oracle Support (MOS) for the specific patch IDs applicable to their installed version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0). If immediate patching is not feasible, restrict TCP access to Coherence cluster ports (default 7574 and cluster member ports) to trusted internal networks and authenticated infrastructure only via network-layer ACLs or firewall rules - this limits the reachable attack surface without requiring application changes but does not eliminate the flaw if internal attackers are in scope. Additionally, audit Coherence role and permission assignments to enforce least-privilege on all principals, reducing the data blast radius of exploitation. Note that network segmentation alone does not remediate the vulnerability and should be treated as a temporary compensating control only.