What is the CVSS score of CVE-2026-60306?

CVE-2026-60306 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60306?

Oracle Coherence, a core component of Oracle Fusion Middleware, is vulnerable to complete remote system takeover by unauthenticated attackers without exploitation barriers-affecting all versions…

How to fix or mitigate CVE-2026-60306?

Within 24 hours: Identify and inventory all systems running Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0; implement firewall rules to restrict TCP access to Coherence services to trusted networks only; establish baseline monitoring for exploitation attempts. Within 7 days: Complete risk assessment documenting business criticality and data sensitivity of each affected system; deploy IDS/IPS signatures for anomalous Coherence protocol activity; brief executive stakeholders on patch availability timeline and contingency plans. Within 30 days: Prepare and test patch deployment runbooks and procedures; continuously monitor Oracle Security Advisories for patch release; evaluate compensating solutions including network segmentation, service isolation, or temporary shutdown of non-critical instances pending vendor fix.

Oracle Coherence CVE-2026-60306

EUVD-2026-46721 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-c5r7-hmg8-2f64

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easily exploitable unauthenticated TCP-network access with no user interaction leading to full takeover, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:21 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) is achievable by an unauthenticated remote attacker over TCP against affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates it CVSS 9.8 with high impact to confidentiality, integrity, and availability, and describes it as 'easily exploitable,' meaning no authentication, no user interaction, and low attack complexity are required. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the network-facing, unauthenticated nature makes it a high-priority patch item.

Technical ContextAI

Oracle Coherence is an in-memory distributed data grid / caching and clustering platform bundled with Oracle Fusion Middleware, commonly embedded in WebLogic-based deployments to provide low-latency data storage, session replication, and cluster coordination. The affected 'Core' component handles clustering and data-grid communication over TCP (Coherence cluster and extend/proxy ports), which is the exposed attack surface here. Oracle's own vector (AV:N/AC:L/PR:N/UI:N) and the 'takeover' outcome are consistent with historically dangerous Coherence flaws driven by unsafe deserialization of untrusted data received over cluster/proxy TCP channels - a common CWE-502 root cause class for this product - although the specific CWE is listed as N/A in the source data and cannot be confirmed.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026 for your Coherence/Fusion Middleware release as the primary fix; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch bundle mapped to each affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). An exact fixed version string is not enumerated in the provided data, so treat the CPU as 'Patch available per vendor advisory' and verify the specific patch number in My Oracle Support before deployment. Until patched, restrict network exposure of Coherence cluster, Extend/proxy, and management TCP ports to trusted management subnets via firewall/security groups (side effect: breaks cross-host clustering if legitimate members are outside the allowed range, so scope carefully); disable or lock down any internet- or DMZ-facing Coherence*Extend proxy listeners; and if unsafe deserialization is the mechanism, enforce Coherence/WebLogic serialization filtering (JEP-290 style allowlists) to reject unexpected classes, accepting that overly strict filters can disrupt legitimate serialized payloads and require tuning.