What is the CVSS score of CVE-2026-60288?

CVE-2026-60288 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60288?

Oracle Coherence, a core enterprise middleware component, has a critical remote access vulnerability (CVE-2026-60288) that allows attackers to take complete control of affected systems without…

How to fix or mitigate CVE-2026-60288?

Within 24 hours, identify all Oracle Coherence instances in production and development environments running affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) and implement firewall rules restricting TCP access from untrusted networks; document any systems that cannot be immediately segmented. Within 7 days, deploy network monitoring rules targeting Coherence ports for suspicious connection attempts, engage Oracle Support to obtain patch availability timelines, and prepare a change management plan for immediate deployment when updates release. Within 30 days, test and deploy any released security patches from Oracle to all affected instances starting with those facing highest external exposure, then confirm remediation via vulnerability scanning and network verification.

Oracle Coherence CVE-2026-60288

EUVD-2026-46703 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-xrjp-whcr-fxrm

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated TCP-reachable pre-auth listener with low complexity and full takeover yields AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H, matching Oracle's assessment.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:29 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network access fully compromise affected servers (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0), disclosed in the Oracle Critical Patch Update of July 2026. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact and is rated 'easily exploitable' by Oracle, meaning no credentials or user interaction are required. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the trivial exploitation profile makes it a high-priority patching target.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid and caching platform bundled with Oracle Fusion Middleware, used to scale application state and clustering across nodes. Cluster members and Coherence*Extend clients communicate over TCP (TCMP transport and the Extend proxy listener), and the affected 'Core' component processes this traffic before authentication. Oracle assigned no CWE (listed N/A), but an unauthenticated, network-reachable TCP vector leading to full takeover is historically consistent with unsafe deserialization of untrusted data in the Coherence protocol/proxy layer, the same root-cause class as prior Coherence RCE issues - this is inferred, not confirmed, since Oracle CPU advisories do not publish CWE mappings or technical root-cause detail. The CPE cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:* identifies the product but does not encode the specific affected version ranges.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Coherence releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, identifying the exact patch bundle for your release from the CPU patch-availability matrix (Oracle does not publish standalone fixed version numbers). Until patching completes, restrict network reachability of Coherence TCMP cluster ports and the Coherence*Extend proxy TCP listener to trusted management segments via firewall/security-group rules - trade-off: this breaks legitimate remote Extend clients and cross-host clustering, so scope rules to known client IPs. Where supported, enable Coherence transport security/TLS and authentication on the Extend proxy, disable any anonymous or unauthenticated proxy listeners, and never expose a Coherence port to the internet. These are compensating controls only; the vendor patch is the sole complete fix.