What is the CVSS score of EUVD-2026-46618?

EUVD-2026-46618 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by EUVD-2026-46618?

Oracle Coherence in Oracle Fusion Middleware is vulnerable to unauthenticated remote attacks that allow complete system compromise without requiring user credentials (CVE-2026-60212, CVSS 9.8).

How to fix or mitigate EUVD-2026-46618?

Within 24 hours, inventory all systems running Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0, classify by business criticality and data sensitivity, and immediately implement network access controls restricting connectivity to these instances to only authorized operational systems. Within 7 days, deploy network segmentation isolating Coherence components, enable real-time monitoring and alerting for suspicious access attempts, and establish daily vendor advisory reviews to detect patch availability from Oracle. Within 30 days, evaluate remediation options including upgrading to patched versions once released by Oracle, migrating workloads to alternative infrastructure, or accepting residual risk with compensating controls, and document business continuity impact of potential compromise.

Oracle Coherence EUVD-2026-46618

| CVE-2026-60212 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-gvwq-fx4f-cpxm

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated network TCP exploitation that is easily exploitable and yields full takeover, so AV:N/AC:L/PR:N/UI:N with High C/I/A.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:57 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (Core component of Oracle Fusion Middleware) allows an unauthenticated attacker with network TCP access to fully compromise the affected instance across confidentiality, integrity, and availability. Oracle rates this 9.8 and describes it as easily exploitable against supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-authentication profile makes it a high-priority patch item from the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid and caching platform bundled with Oracle Fusion Middleware and frequently embedded via WebLogic Server to scale stateful Java applications across clustered nodes. Cluster and proxy communication occurs over TCP (Coherence cluster ports and the Coherence*Extend proxy), which is the network surface implicated by the AV:N/TCP vector. The advisory does not assign a CWE (CWE: N/A), but full C/I/A 'takeover' against a Java middleware data grid is consistent with the unsafe-deserialization or unauthenticated remote-protocol handling class historically seen in Coherence and Fusion Middleware - this remains an inference, since Oracle's CPU entries deliberately omit technical root-cause detail. The CPE cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:* confirms the affected product is Coherence itself rather than a specific sub-component.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which contains the fix for the affected 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 baselines; consult the exact patch and interim-patch numbers per version in the advisory at https://www.oracle.com/security-alerts/cpujul2026.html (patch available per vendor advisory - no standalone fix version string is provided in the input, so use Oracle's CPU patch matrix). Until patching is complete, restrict network access to Coherence cluster and Coherence*Extend proxy TCP ports so they are reachable only from trusted application hosts via firewall or network segmentation, which blocks untrusted clients but will break any legitimate cross-network cluster or client connectivity that is not explicitly allowlisted. Where the Coherence*Extend proxy is not required, disable that exposed proxy service, and never expose Coherence ports to the internet; validate these controls against your clustering topology first, as over-restriction can partition a live data grid.