What is the CVSS score of CVE-2026-60283?

CVE-2026-60283 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Coherence CVE-2026-60283

EUVD-2026-46698 MEDIUM

Information Exposure (CWE-200)

2026-07-21 oracle

GHSA-h3j5-hmqm-hfpr

Information Disclosure Oracle Oracle Coherence Oracle Corporation

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

HTTP-accessible Core component requires no credentials per PR:N; only partial data read confirmed so C:L; no integrity or availability impact described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:09 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized read access to Oracle Coherence data is achievable by unauthenticated network attackers targeting the Core component via HTTP across all current supported releases (12.2.1.4.0 through 15.1.1.0.0). The 'Authentication Bypass' tag combined with a PR:N CVSS vector confirms that no credentials are required, but impact is bounded to a partial subset of accessible data (C:L), not full cluster compromise. No public exploit or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the trivially low exploitation complexity.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching solution within the Oracle Fusion Middleware stack, commonly deployed in large enterprise Java environments for high-availability session management, distributed data stores, and event-driven processing. The vulnerability resides in the Core component, reachable over HTTP, indicating that an exposed service interface - likely a management REST API, Coherence*Extend proxy, or similar HTTP-accessible endpoint - fails to enforce authentication for certain requests. The CWE field is listed as N/A by the reporter, limiting formal root-cause classification, but the 'Authentication Bypass' tag applied by EUVD-2026-46698 is consistent with a missing or bypassable access control gate on one or more Core HTTP handlers. Affected CPE: cpe:2.3:a:oracle_corporation:oracle_coherence covering versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update patches per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Exact patched build version numbers are not independently enumerated in the available intelligence - consult the CPU document directly for the specific patch IDs and version strings applicable to each affected release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). As a compensating control while patching, restrict HTTP access to Oracle Coherence Core services at the network perimeter using firewall rules or reverse proxy ACLs to allow only trusted internal IP ranges, accepting the operational trade-off that this may reduce accessibility for legitimate internal consumers. Additionally, audit and disable any unused HTTP-facing Coherence endpoints such as the management REST API or Coherence*Extend HTTP acceptor if not required by the deployment, which reduces the reachable attack surface without impacting grid functionality for non-HTTP clients.