What is the CVSS score of CVE-2026-60302?

CVE-2026-60302 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by CVE-2026-60302?

Oracle Coherence in-memory data grids can be remotely compromised by unauthenticated attackers, enabling complete access to sensitive cached data and potential system manipulation.

How to fix or mitigate CVE-2026-60302?

Within 24 hours, inventory all systems running Oracle Coherence and verify network reachability from untrusted segments; immediately restrict TCP access to Coherence cluster ports (default 7574, 7575, or configured alternatives) to only authorized administration systems. Within 7 days, enforce network segmentation or firewall rules blocking external access to cluster ports, enable audit logging of all cluster access attempts, and verify no Coherence instances are accessible from the internet. Within 30 days, monitor Oracle's security advisories daily for patch availability (July 2026 CPU or subsequent releases) and maintain a prepared staging environment for immediate patch deployment and testing upon vendor release.

Oracle Coherence CVE-2026-60302

EUVD-2026-46717 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-368c-8453-jwg6

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated, network-reachable, easily exploitable full takeover, so AV:N/AC:L/PR:N/UI:N with full C/I/A high and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:23 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network access fully compromise the in-memory data grid. Oracle rates this CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning a single crafted network interaction against a reachable cluster node can yield complete control. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low complexity and no-authentication profile make it a high-priority patch in the July 2026 Oracle Critical Patch Update.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid and caching platform bundled with Oracle Fusion Middleware and WebLogic Server, used to share and cluster application state across JVM nodes over TCP (typically the Coherence*Extend proxy and cluster ports). The flaw resides in the Core component and is reachable over the cluster/proxy network protocol. Oracle assigned no CWE (CWE: N/A), but the pattern of unauthenticated network-based full takeover in Java middleware of this type is historically consistent with unsafe deserialization of untrusted data (CWE-502) in the Coherence wire protocol; this root-cause class is inferred from the impact profile, not confirmed by Oracle. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence:*, spanning multiple middleware release trains.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update (CPU) for Oracle Coherence, which addresses the affected release trains 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch bundle and version applicable to your deployment. Patch status: patch available per vendor advisory (Oracle CPU) - an exact fix version string is not enumerated in the provided data, so verify the specific bundle in the advisory and do not treat any version number as confirmed without checking. Until patched, restrict network access to Coherence cluster and Coherence*Extend proxy ports (commonly TCP 8088/9099 and dynamically allocated cluster ports) with firewall rules and network segmentation so only trusted application hosts can reach them, and never expose these ports to the internet or untrusted VLANs (trade-off: overly tight rules can break legitimate cross-node clustering, so validate cluster membership after changes). Where Coherence*Extend is not required, disable the proxy service to shrink the attack surface. Enable the Coherence Security Framework and SSL for cluster and extend traffic where supported to require authentication and encryption on the wire (trade-off: added configuration effort and slight latency).