What is the CVSS score of CVE-2026-60295?

CVE-2026-60295 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Coherence are affected by CVE-2026-60295?

Oracle Coherence 14.1.1, 14.1.2, and 15.1.1 contain a critical vulnerability enabling complete system takeover by low-privilege network attackers, with no patch currently available.

How to fix or mitigate CVE-2026-60295?

Within 24 hours: Inventory all Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 instances; document network location, privilege levels, and dependent systems; enable TCP monitoring on Coherence ports. Within 7 days: Implement network segmentation to restrict Coherence access to authorized administrators only; audit and revoke unnecessary low-privilege credentials with network access to Coherence; contact Oracle support to confirm patch timeline and interim guidance. Within 30 days: Deploy intrusion detection signatures for Coherence TCP ports; validate backup and recovery procedures for dependent applications; evaluate remediation options including architectural redesign, version upgrade if available, or workload isolation to segregate Coherence exposure.

Oracle Coherence CVE-2026-60295

EUVD-2026-46710 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-hrhq-5gqf-mrh6

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

8.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

Network-reachable but Oracle rates it difficult (AC:H) and requiring low privilege (PR:L); scope change (S:C) and full takeover justify C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:25 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

HIGH 8.5

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence (Fusion Middleware Core) is possible by a low-privileged network attacker over TCP in supported versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with a scope change that can significantly impact additional co-located products beyond Coherence itself. Rated CVSS 3.1 8.5 with high confidentiality, integrity and availability impact, though the high attack complexity means exploitation is not trivial. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform bundled with Oracle Fusion Middleware, used to cluster application state and share data across nodes over TCP-based cluster protocols (TCMP and Coherence*Extend). The flaw is in the Core component and produces a scope change (S:C), which for a data grid typically means abuse of the clustering/serialization layer lets an attacker escape the trust boundary of the Coherence process and reach other co-located Fusion Middleware components. Oracle assigned no CWE, but a network-reachable, scope-changing takeover of a Java data grid is consistent with unsafe deserialization or over-trust of clustered peer input, a recurring root-cause class for this software category.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory for Coherence 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; Oracle lists the exact patch and bundle numbers per version in the CPU matrix, so apply the entry matching your deployed release. Until patched, restrict network access to Coherence cluster and Coherence*Extend proxy ports (TCMP and Extend listeners) to trusted management segments via firewall or security groups, which limits the AV:N reach but will break legitimate remote grid clients and cross-datacenter clustering. Enforce authentication and TLS on Coherence*Extend and TCMP using the Coherence security framework and identity tokens so the required low-level privilege cannot be trivially obtained, at the cost of certificate and identity-management overhead. Where feasible, isolate the Coherence tier from other Fusion Middleware components to contain the scope-change pivot.