What is the CVSS score of CVE-2026-60305?

CVE-2026-60305 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle Coherence are affected by CVE-2026-60305?

Oracle Coherence versions 12.2.1.4.0 through 15.1.1.0.0 contain a data tampering vulnerability (CVE-2026-60305) that enables low-privileged attackers to create, delete, or modify critical business…

How to fix or mitigate CVE-2026-60305?

Within 24 hours, identify all systems running affected Coherence versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) and assess which systems process critical or sensitive data. Within 7 days, implement network-level controls by restricting TCP access to affected Coherence systems through firewall rules and enforce principle of least privilege for all application accounts accessing these systems. Within 30 days, monitor Oracle security advisories for patch releases and develop a phased upgrade plan, prioritizing systems processing the most critical data for timely patching once available.

Oracle Coherence CVE-2026-60305

EUVD-2026-46720 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-p29p-78r2-9xhp

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

7.1 HIGH

Network-reachable TCP listener with low complexity and no UI; requires a low-privileged foothold (PR:L); high integrity/tampering impact, limited confidentiality, no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:21 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Coherence accessible data as well as unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

AnalysisAI

Data tampering in Oracle Coherence (Core component) of Oracle Fusion Middleware allows a low-privileged attacker with TCP network access to create, delete, or modify critical data and read a subset of accessible data. Versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected, with Oracle rating the flaw easily exploitable (CVSS 3.1 base 7.1, high integrity impact). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid (IMDG) used within Oracle Fusion Middleware for caching, clustering, and low-latency data management across application server tiers, typically exposed over TCP (cluster/proxy and Coherence*Extend listeners). The flaw resides in the Core component and, per the supplied tags, involves an Authentication Bypass allowing a low-privileged principal to perform operations beyond its authorization boundary. No CWE was assigned in the input (CWE: N/A); based on the Authentication Bypass tag and the C:L/I:H impact profile, the root-cause class is most consistent with improper authentication/authorization enforcement (CWE-287/CWE-862 family) rather than a memory-safety or injection bug. The single CPE provided (cpe:2.3:a:oracle_corporation:oracle_coherence) is version-agnostic (wildcard), so exact affected builds must be taken from the description's version list rather than the CPE.

RemediationAI

Apply the patches from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); the input does not name an exact fixed build, so Patch available per vendor advisory - consult the CPU patch matrix to select the correct Coherence bundle patch for your version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0). Until patched, reduce exposure by restricting network reachability of Coherence cluster and Coherence*Extend/proxy TCP listeners to trusted management segments via firewall/ACLs so untrusted or low-privileged clients cannot reach them (trade-off: may break legitimate remote Extend clients and cross-tier cluster members, so validate topology first). Enforce authentication and TLS on Coherence*Extend proxies and tighten role/authorization configuration to limit what low-privileged principals can invoke (trade-off: configuration changes require testing to avoid disrupting clustered applications). These are compensating controls only and do not replace the vendor patch.