What is the CVSS score of CVE-2026-60304?

CVE-2026-60304 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Oracle Coherence CVE-2026-60304

EUVD-2026-46719 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-433m-qr8c-jg6w

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable via TCP with low privilege required; impact is strictly complete availability loss with no confidentiality or integrity exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:05 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial of service in Oracle Coherence's Core component allows a low-privileged network attacker to cause a hang or repeatable crash of the service via TCP, affecting all four currently supported release lines (12.2.1.4.0 through 15.1.1.0.0). Oracle classifies this as easily exploitable - low attack complexity and no user interaction required - making it accessible to any authenticated user with TCP connectivity to the cluster. No public exploit has been identified at time of analysis, and Oracle disclosed this through its July 2026 Critical Patch Update; the CVE is not listed in CISA KEV.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform used in enterprise Java applications as a core component of Oracle Fusion Middleware. The affected CPE (cpe:2.3:a:oracle_corporation:oracle_coherence) covers all four confirmed release lines. The vulnerability resides in the Core component, which governs distributed data management, cluster coordination, and TCP-based inter-node communication. No CWE is assigned, but the denial-of-service outcome - hang or repeatable crash - triggered over TCP by a low-privileged user is consistent with improper input validation, resource exhaustion, or unhandled exception handling within the cluster messaging subsystem. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms the flaw is remotely reachable under typical network conditions without complex prerequisites, but does require a minimum level of authentication.

RemediationAI

Apply the patches provided in Oracle's July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version numbers for each affected release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) are not specified in available intelligence and must be confirmed directly from the CPU advisory and Oracle Support. As compensating controls pending patching, restrict network access to Oracle Coherence TCP cluster ports (typically 7574, 7575, and associated cluster management ports) at the firewall or network layer to only explicitly authorized hosts and users; this directly limits the pool of low-privileged attackers who can reach the vulnerable endpoint. Note that overly broad port restrictions may disrupt cluster formation, replication, and management operations - validate any firewall rule changes against your cluster topology before applying in production.