What is the CVSS score of CVE-2026-60309?

CVE-2026-60309 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Coherence are affected by CVE-2026-60309?

An unpatched vulnerability in Oracle Coherence allows attackers positioned on the same network segment to completely compromise affected systems without authentication.

How to fix or mitigate CVE-2026-60309?

Within 24 hours, identify and inventory all Oracle Coherence instances in your environment running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0, and immediately restrict network access to these systems using firewall rules and network segmentation to limit connectivity to only authorized adjacent network segments. Within 7 days, implement comprehensive logging and alerting on Coherence systems to detect exploitation attempts, disable unnecessary network services and remote management interfaces, and establish a vendor advisory monitoring process to deploy patches immediately upon release. Within 30 days, coordinate with Oracle for patch availability and develop a timeline for upgrading affected Coherence instances; evaluate architectural options for isolating or replacing Coherence if it remains unpatched and is critical to operations.

Oracle Coherence CVE-2026-60309

EUVD-2026-46724 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-xhjx-g246-395x

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Adjacent vector (AV:A) because exploitation needs access to the Coherence communication segment; unauthenticated (PR:N) and low complexity per Oracle, with full C/I/A takeover.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:20 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Coherence executes to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) is possible by an unauthenticated attacker positioned on the same physical/adjacent network segment as the affected host, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable, though no public exploit identified at time of analysis and it is not listed in CISA KEV. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform used within Oracle Fusion Middleware to provide clustered, low-latency data services for Java enterprise applications. Cluster members communicate over Coherence's TCMP (Tangosol Cluster Management Protocol) and related cluster transport channels, which is consistent with the CVSS Adjacent (AV:A) attack vector requiring access to the physical communication segment attached to the Coherence host. The CWE is not provided by the source, but the outcome - unauthenticated 'takeover' reachable from the cluster network - is characteristic of unauthenticated cluster-join / deserialization / missing-authentication weaknesses common to data-grid transports; the exact root-cause class cannot be confirmed from the available data. The CPE (cpe:2.3:a:oracle_corporation:oracle_coherence) confirms the affected product is the Coherence application itself.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and vendor-authoritative remediation for all affected releases (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); the advisory lists patch available per vendor advisory, though an exact per-release patched build number is not reproduced in the provided data and should be taken from the CPU patch matrix. Because the attack requires access to the Coherence communication segment, the most effective compensating control until patching is network isolation: place Coherence cluster traffic (TCMP/well-known-address ports) on a dedicated, firewalled VLAN or backend segment unreachable by application or user hosts, which reduces exposure but requires ensuring all legitimate cluster members remain on that segment. Where supported, enable Coherence transport/cluster security (host address authorization and TLS/SSL for cluster communication) to authenticate members, accepting the operational overhead of certificate management and configuration changes. Avoid running Coherence nodes on shared or trusted broadcast segments alongside untrusted workloads.