What is the CVSS score of CVE-2026-60298?

CVE-2026-60298 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60298?

Oracle Coherence (Oracle Fusion Middleware Core) versions 14.1.1-15.1.1 are vulnerable to unauthenticated remote complete takeover (CVSS 9.8), with no vendor patch currently available.

How to fix or mitigate CVE-2026-60298?

Within 24 hours, complete an inventory of all Oracle Coherence deployments in versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 and determine network exposure; immediately implement firewall rules to restrict TCP access to affected instances to trusted internal networks only, or isolate critical instances if operationally feasible. Within 7 days, deploy enhanced logging and intrusion detection signatures to monitor for exploitation attempts; engage your Oracle account team to confirm patch ETA; evaluate temporary workarounds such as disabling non-critical Coherence nodes or architectural changes to reduce attack surface. Within 30 days, apply the vendor patch immediately upon release to all affected versions, or migrate to patched releases if available; validate that mitigations are effective and can be removed post-remediation.

Oracle Coherence CVE-2026-60298

EUVD-2026-46713 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-pmm7-xcv3-wjp6

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easily exploitable unauthenticated network TCP access yielding full takeover, so AV:N/AC:L/PR:N/UI:N with high C/I/A; no cross-component scope change indicated (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:24 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update, affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates it CVSS 9.8 with full confidentiality, integrity and availability impact and describes it as 'easily exploitable,' meaning no user interaction, privileges, or special preconditions are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity unauthenticated network profile makes it a high-priority patch.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching/clustering platform bundled with Oracle Fusion Middleware, used to scale and cluster stateful Java applications (notably WebLogic-based deployments) by sharing objects across JVM nodes over TCP. The affected component is 'Core,' the clustering/data-grid engine that listens on network sockets for inter-node and client traffic. Oracle did not assign a CWE (CWE: N/A) and did not disclose the root-cause class in the advisory; however, unauthenticated full-takeover flaws in Coherence and comparable Java middleware historically stem from unsafe deserialization of untrusted objects reaching cluster/extend listener ports, which allows an attacker to drive arbitrary object instantiation and code execution. The single affected CPE, cpe:2.3:a:oracle_corporation:oracle_coherence, confirms the product scope but carries no version bounds in the provided data.

RemediationAI

Apply the patches from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 branches; Oracle publishes fixed bundle-patch numbers there but no exact fixed build was included in the provided data, so consult the CPU matrix for the precise patch for your version. Because Coherence exploitation requires reaching its cluster and Extend/proxy listener ports, the primary compensating control until patching is network isolation: restrict Coherence cluster and Extend ports to trusted management subnets via firewall/security-group rules and place the data grid behind a segmented internal network, never exposing it to untrusted or internet-facing clients - the trade-off is that legitimate remote Extend clients must be explicitly allowlisted. Where Coherence security is available, enable authentication/SSL on Extend proxies to limit anonymous connections, accepting the operational overhead of certificate and credential management. These are mitigations only; prioritize the vendor patch, as no independently confirmed workaround fully removes the flaw.