What is the CVSS score of CVE-2026-60287?

CVE-2026-60287 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60287?

Oracle Coherence, a core Oracle Fusion Middleware component used by many organizations for distributed caching and data management, is vulnerable to complete remote takeover by any network attacker…

How to fix or mitigate CVE-2026-60287?

Within 24 hours: Identify and inventory all systems running Oracle Coherence, determine their network exposure (especially internet-facing or untrusted network access), and immediately implement firewall rules restricting access to Coherence ports (typically 7574, 7575, or 7576) to only trusted internal networks and administrator IPs. Within 7 days: Conduct a full network segmentation assessment, implement monitoring and alerting for unexpected connections to Coherence services, notify business stakeholders of the vulnerability and interim controls, and establish a process to check Oracle's Critical Patch Update advisories weekly for available fixes. Within 30 days: Monitor Oracle Security Alerts for a released patch to CVE-2026-60287, validate the patch in a non-production environment, and plan phased deployment across production systems; in parallel, evaluate whether Coherence services can be temporarily disabled or relocated to isolated environments if no patch timeline emerges.

Oracle Coherence CVE-2026-60287

EUVD-2026-46702 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-9v83-jwfv-mh98

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor confirms unauthenticated, low-complexity network TCP exploitation with no user interaction yielding full takeover, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:29 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) is possible by remote, unauthenticated attackers over TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with High impact to confidentiality, integrity, and availability, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reachability, no authentication, and complete compromise makes it a top-priority patch.

Technical ContextAI

Oracle Coherence is an in-memory data grid / distributed caching and clustering platform embedded in Oracle Fusion Middleware and commonly paired with WebLogic Server. The affected 'Core' component handles cluster membership and inter-node data exchange over TCP (Coherence traditionally uses TCMP/Extend proxy protocols). Oracle did not assign a CWE (listed N/A), but 'takeover of Oracle Coherence' by an unauthenticated network client is consistent with the deserialization-of-untrusted-data class (CWE-502) that has historically affected Coherence and other Java middleware, where a crafted object sent to a listening cluster/proxy port is deserialized and leads to remote code execution. The single CPE provided (cpe:2.3:a:oracle_corporation:oracle_coherence:*) confirms the product but not a precise version boundary; Oracle's advisory enumerates the affected supported releases.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to all affected Coherence releases (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); Oracle delivers these as CPU patches rather than a single tagged fix version, so use the patch bundle matched to your exact release (patch available per vendor advisory - no standalone fix version stated in the provided data). Until patching, reduce exposure by restricting network access to Coherence cluster and Extend/proxy TCP ports (e.g. TCMP and the Extend proxy listener) to trusted management subnets via firewall/security-group rules, and disable or firewall any internet- or DMZ-facing Coherence Extend proxy that does not need external clients - the trade-off is that legitimate remote Extend clients and cross-host cluster members must be explicitly allowlisted or they will lose connectivity. Where Coherence supports it, enable authentication/TLS on cluster and Extend traffic and enforce an object-deserialization allowlist (POF/serialization filter), accepting the operational cost of validating that all legitimate serialized types are permitted.