What is the CVSS score of CVE-2026-60300?

CVE-2026-60300 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60300?

Oracle Coherence, a critical in-memory data grid component of Oracle Fusion Middleware, is vulnerable to unauthenticated remote takeover via CVE-2026-60300 (CVSS 9.8).

How to fix or mitigate CVE-2026-60300?

Within 24 hours: Inventory all systems running affected Coherence versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) and restrict network access to Coherence cluster ports to trusted sources only. Within 7 days: Enable enhanced monitoring and logging on all Coherence nodes, consult Oracle security advisories for interim workarounds, and begin planning an upgrade or migration path. Within 30 days: Apply the vendor-released patch immediately upon release from Oracle's Critical Patch Update program, or execute a validated alternative deployment architecture if a patch timeline exceeds risk tolerance.

Oracle Coherence CVE-2026-60300

EUVD-2026-46715 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-v9wx-p978-mg3q

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated (PR:N) network TCP access (AV:N) is easily exploitable (AC:L) with no user interaction (UI:N), yielding full takeover, so C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:23 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker with TCP network access to fully compromise the affected in-memory data grid, per Oracle's July 2026 Critical Patch Update. Oracle rates the flaw CVSS 9.8 with 'easily exploitable' language and complete confidentiality, integrity, and availability impact, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was provided.

Technical ContextAI

Oracle Coherence is a distributed, in-memory data grid and caching platform bundled with Oracle Fusion Middleware, used to scale stateful applications across a cluster of JVM nodes that communicate over TCP via cluster ports and the Coherence*Extend proxy listener. The vulnerability is in the 'Core' component and is reachable over the network via TCP, which for Coherence typically means the Extend proxy or cluster communication path that processes attacker-supplied serialized data. No CWE was assigned in the input; however, unauthenticated 'takeover' via network requests to a Java middleware data grid is characteristically consistent with an unsafe deserialization / object-processing weakness (CWE-502 class) - this root cause is inferred, not confirmed by Oracle.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 - Patch available per vendor advisory (Oracle CPUs deliver cumulative patches; take the exact patched build from the CPU matrix, as a specific fixed version string was not provided in the input). Because exploitation is unauthenticated over TCP, until patching completes restrict network exposure of the Coherence*Extend proxy and cluster TCP ports to trusted management subnets via firewall/ACLs and remove any internet exposure - the trade-off is that legitimate remote Extend clients on other networks lose connectivity and must be explicitly whitelisted. Where supported, enable Extend client authentication/identity tokens and TLS on the proxy listeners to raise the barrier, accepting the certificate-management and configuration overhead. These are compensating controls only; the CPU patch is the authoritative fix.