What is the CVSS score of EUVD-2026-46603?

EUVD-2026-46603 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by EUVD-2026-46603?

Oracle Coherence, a core middleware component in Oracle Fusion systems, contains a critical vulnerability (CVE-2026-60197, CVSS 9.8) enabling unauthenticated remote attackers to achieve complete…

How to fix or mitigate EUVD-2026-46603?

Within 24 hours: Conduct an inventory of all systems running Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and immediately isolate them from untrusted networks through firewall restrictions until remediation is complete. Within 7 days: Escalate to Oracle Support to confirm patch availability and obtain the July 2026 Critical Patch Update; if patches are released, establish an emergency change window to deploy updates beginning with production environments. Within 30 days: Apply all available patches to remaining affected instances, validate remediation through vulnerability scanning, and document completion; if patches remain unavailable, implement permanent network segmentation restricting TCP access to Coherence instances to only authorized internal systems with network monitoring enabled.

Oracle Coherence EUVD-2026-46603

| CVE-2026-60197 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-qqx6-m9f9-7qx9

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated, easily exploitable network TCP access yielding full takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:04 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated remote attacker with TCP network access to compromise the affected instance, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' Affected releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid and caching platform bundled with Oracle Fusion Middleware and commonly deployed alongside Oracle WebLogic Server for stateful clustering and session/data replication. Cluster members and clients communicate over TCP (Coherence*Extend / TCMP protocols), and the vulnerability resides in the 'Core' component reachable over that network path. No CWE was assigned in the input, but the combination of unauthenticated network access, low complexity, and full-system takeover is consistent with an unsafe-deserialization or protocol-processing flaw in the cluster/proxy listener - a class historically seen in Coherence and WebLogic; this root cause is inferred from the CVSS vector and impact, not confirmed by Oracle's public wording.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update - July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to each affected release train (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); the input does not include a specific patched build number, so consult the CPU matrix for the exact patch ID per version and do not deploy an invented version string. As Patch available per vendor advisory, prioritize internet-exposed and DMZ-facing Coherence instances first. Compensating controls until patching completes: restrict Coherence*Extend proxy and TCMP cluster ports to trusted management subnets via firewall/network ACLs (trade-off: breaks external Coherence clients that connect over those ports); place Coherence behind a segmented network so the proxy listener is unreachable from user or internet zones; and if Coherence*Extend is not required, disable the proxy service in the cache configuration (trade-off: remote client access is lost). Enable and monitor logging on the proxy/cluster listeners for anomalous connections.