What is the CVSS score of CVE-2026-60290?

CVE-2026-60290 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60290?

Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are vulnerable to unauthenticated remote complete system compromise (CVSS 9.8) via malicious HTTP requests.

How to fix or mitigate CVE-2026-60290?

Within 24 hours, identify and inventory all systems running Coherence 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 across production and non-production environments; map critical dependencies and data sensitivity. Within 7 days, implement network segmentation to restrict HTTP/HTTPS access to affected Coherence instances to authorized internal sources only, deploy Web Application Firewall rules blocking suspicious HTTP patterns targeting Coherence ports, and establish rate limiting on Coherence communication channels. Within 30 days, contact Oracle support for available workarounds or upgrade timelines, assess feasibility of emergency architecture changes to reduce Coherence exposure or migrate critical data, and establish continuous monitoring for unauthorized data-grid access attempts with immediate escalation protocols.

Oracle Coherence CVE-2026-60290

EUVD-2026-46705 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-w2jf-9c99-w76q

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easily exploitable unauthenticated HTTP-based takeover with full C/I/A impact, giving AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:28 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete compromise of Oracle Coherence (Oracle Fusion Middleware Core component) is possible by unauthenticated remote attackers sending crafted HTTP traffic, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 and results in full takeover of the Coherence data-grid instance across affected versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Oracle Coherence is an in-memory distributed data-grid and caching platform bundled with Oracle Fusion Middleware, commonly deployed alongside WebLogic to provide clustering, session replication, and low-latency caching for enterprise Java applications. The vulnerable 'Core' component handles cluster communication and remote client/extend proxy requests over the network. Oracle did not assign a CWE (listed as N/A), but the combination of an unauthenticated, network-reachable HTTP vector resulting in full takeover is characteristic of unsafe deserialization or remote-object/method invocation flaws historically seen in Coherence and other Fusion Middleware components; the exact root-cause class is not disclosed in the available data.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (Patch available per vendor advisory; an exact standalone fix version is not enumerated in the provided data) documented at https://www.oracle.com/security-alerts/cpujul2026.html, prioritizing this update given the 9.8 severity and unauthenticated network vector. Until patching is complete, restrict network exposure of Coherence cluster and Extend/proxy ports so they are reachable only from trusted application tiers via firewall or security-group rules, place Coherence behind a segmented internal network rather than any internet-facing path, and enforce Coherence Extend TCP-only proxies with authentication/TLS where supported - noting that tightening proxy access or blocking ports can disrupt legitimate cross-tier caching and cluster traffic and should be validated against application dependencies. Do not rely on the coarse 'Information Disclosure' tag to downgrade urgency; the vendor describes full takeover.