What is the CVSS score of CVE-2026-60299?

CVE-2026-60299 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60299?

Oracle Coherence in Fusion Middleware versions 14.1.1, 14.1.2, and 15.1.1 can be fully compromised remotely by unauthenticated attackers without user interaction.

How to fix or mitigate CVE-2026-60299?

Within 24 hours: Conduct an inventory of all systems running Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0; restrict network access to Coherence instances to trusted internal sources only; enable detailed audit logging on all affected systems. Within 7 days: Deploy intrusion detection rules and network-based detection signatures targeting exploitation attempts against Coherence; establish incident response procedures and communication plans for potential active compromise; evaluate operational feasibility of temporarily air-gapping or deactivating non-critical Coherence clusters. Within 30 days: Monitor Oracle's official security advisories and Critical Patch Update schedules for patch availability; conduct full testing of patches in non-production environments; deploy patches immediately upon release, beginning with production systems supporting critical business functions.

Oracle Coherence CVE-2026-60299

EUVD-2026-46714 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-v356-cpj3-4qmv

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated network TCP access with easy exploitation and full takeover, giving AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:24 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid and caching platform bundled with Oracle Fusion Middleware, used for clustering and scaling stateful Java applications. Cluster and client communication occurs over TCP via Coherence's proprietary protocols (TCMP for cluster traffic and Coherence*Extend for remote clients), which have historically been affected by unsafe Java object deserialization. Oracle did not assign a CWE (CWE: N/A) and the advisory does not disclose the root cause, but a network-reachable, unauthenticated 'takeover' with full C/I/A impact in a Java data-grid Core component is consistent with a deserialization or protocol-parsing flaw; this root-cause attribution is inferred, not confirmed by Oracle. The CPE cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:* confirms the affected product but does not pin exact version boundaries beyond those named in the description.

RemediationAI

Apply the patches from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to the affected 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 releases; the input does not include an exact fixed build number, so treat this as 'patch available per vendor advisory' and pull the specific patch level for your Coherence version directly from the CPU matrix. Until patched, reduce exposure by restricting network access to Coherence cluster (TCMP) and Coherence*Extend proxy TCP ports to only trusted management/application hosts via firewall or network segmentation, which limits the unauthenticated attack surface at the cost of breaking connectivity for any client or cluster member not on the allowlist. If your deployment supports it, enable TLS/SSL and authentication on Coherence*Extend proxies and consider Coherence's deserialization filtering / allowlist controls to constrain accepted object types, accepting the operational overhead and potential compatibility testing those controls require.