What is the CVSS score of CVE-2026-60297?

CVE-2026-60297 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60297?

Oracle Coherence, a critical in-memory data grid component of Oracle Fusion Middleware, is exploitable by unauthenticated attackers to achieve complete system compromise.

How to fix or mitigate CVE-2026-60297?

Within 24 hours: identify and inventory all systems running Oracle Fusion Middleware and determine Coherence deployment scope; immediately restrict network access to Coherence TCP ports (typically 8088-8089) via firewall rules to trusted internal subnets only if systems are internet-facing. Within 7 days: implement enhanced monitoring and alerting on all Coherence network connections for anomalous activity; review and test your backup and disaster recovery procedures to ensure rapid restoration capability; document which applications and data depend on Coherence to prioritize mitigation. Within 30 days: continuously monitor Oracle Security Advisories for a vendor-released patch; conduct a phased testing plan when a fix is available, prioritizing business-critical systems and those processing sensitive data.

Oracle Coherence CVE-2026-60297

EUVD-2026-46712 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-v49w-fxhf-64xf

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated network TCP exploitation is easy and yields full takeover, so AV:N/AC:L/PR:N/UI:N with high C/I/A and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:25 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the network (TCP) by an unauthenticated remote attacker per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 reflects complete confidentiality, integrity, and availability loss (product takeover) with no authentication or user interaction required. No public exploit identified at time of analysis, and it is not listed in CISA KEV, so exploitation is not yet confirmed in the wild.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid / caching platform used to scale stateful Java applications, frequently deployed alongside Oracle WebLogic Server within Fusion Middleware. Cluster nodes and Coherence*Extend clients communicate over TCP using Coherence's own wire protocols (TCMP and Extend), which historically transport serialized Java objects. The advisory does not assign a CWE (CWE: N/A), but the pattern of an unauthenticated network-facing TCP flaw resulting in full takeover of a Java middleware product is characteristic of insecure deserialization of untrusted data (CWE-502), which has been the root cause of prior Coherence takeover CVEs; this class attribution is inferred, not vendor-confirmed. The affected component is identified only as 'Core' (CPE cpe:2.3:a:oracle_corporation:oracle_coherence).

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for each affected release train (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); Oracle does not publish standalone fixed build numbers outside the CPU, so treat patch status as 'Patch available per vendor advisory' and pull the exact patch IDs from the CPU matrix for your version. Until patched, restrict network exposure of Coherence: firewall the Coherence cluster (TCMP) and Coherence*Extend proxy TCP ports so they are reachable only from trusted application hosts, place Coherence nodes on an isolated back-end network segment, and avoid binding Extend proxies to internet- or DMZ-facing interfaces (trade-off: legitimate remote Extend clients must be explicitly allow-listed). Where supported, enable TLS/SSL and client authentication on Extend proxies and cluster socket providers to raise the bar (trade-off: certificate and configuration management overhead). These are compensating controls only and do not remove the underlying flaw.