What is the CVSS score of CVE-2026-60296?

CVE-2026-60296 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60296?

Oracle Coherence deployments in Fusion Middleware versions 12.2.1.4.0 through 15.1.1.0.0 face complete remote takeover via unauthenticated network access (CVE-2026-60296, CVSS 9.8).

How to fix or mitigate CVE-2026-60296?

Within 24 hours, identify all systems running Oracle Fusion Middleware versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 with active Coherence clusters and immediately restrict TCP network access to Coherence ports from untrusted networks; implement perimeter firewall rules to limit connectivity to pre-approved internal sources only and establish continuous monitoring for connection attempts. Within 7 days, complete network segmentation isolating Coherence clusters on dedicated internal network segments, deploy intrusion detection signatures targeting CVE-2026-60296 exploitation patterns, disable all unnecessary remote management interfaces, and formally escalate to Oracle Support to confirm patch release timeline. Within 30 days, apply the vendor patch to all affected systems immediately upon release, conduct forensic analysis of Coherence transaction logs and data access for indicators of compromise, and validate incident response procedures for cluster isolation and failover.

Oracle Coherence CVE-2026-60296

EUVD-2026-46711 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-96r7-rw69-mxrv

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated TCP-reachable takeover with no user interaction gives AV:N/AC:L/PR:N/UI:N, and full product compromise justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:25 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Core-component flaw in Oracle Fusion Middleware releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates the issue "easily exploitable" with a CVSS 3.1 base score of 9.8 and full confidentiality, integrity and availability impact, meaning a remote actor can seize control of the in-memory data grid without credentials. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

Oracle Coherence is an in-memory distributed data grid and caching platform used within the Oracle Fusion Middleware stack to provide clustered, high-throughput storage for WebLogic and other enterprise applications. Cluster members communicate over TCP (Coherence*Extend proxies and cluster ports), and the affected surface is the product's Core component, which handles cluster membership, serialization and request processing. Oracle did not assign a CWE, but a network-facing, unauthenticated "takeover" of a Java data-grid Core typically stems from an insecure deserialization or protocol-handling weakness in the wire format exchanged between clients/nodes - though the specific root-cause class is not confirmed in the provided data. The single CPE, cpe:2.3:a:oracle_corporation:oracle_coherence:*, confirms the product without pinning a version range beyond the four supported releases named in the description.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to each affected release train - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; treat patching as urgent given the 9.8 score and unauthenticated network vector. Patch available per vendor advisory (Oracle CPU July 2026); consult the CPU matrix for the exact patched build per version. Until patches are deployed, restrict network reachability of Coherence cluster and Coherence*Extend proxy TCP ports to trusted management segments only via firewall/ACLs, ensure no Coherence port is internet-exposed, and place proxies behind authenticated gateways - the trade-off is that overly tight ACLs can disrupt legitimate cluster membership or Extend client connectivity, so validate cluster node lists before enforcing. Where supported, enabling Coherence transport security/TLS and Extend authentication reduces exposure to anonymous connections.