What is the CVSS score of EUVD-2026-46621?

EUVD-2026-46621 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by EUVD-2026-46621?

Oracle Coherence versions 12.2.1.4.0 through 15.1.1.0.0 are vulnerable to unauthenticated remote complete system takeover via CVE-2026-60215 (CVSS 9.8).

How to fix or mitigate EUVD-2026-46621?

Within 24 hours: Inventory all Oracle Coherence deployments across the organization and document versions, network scope, and data criticality; assess whether instances are directly accessible from untrusted networks or the internet. Within 7 days: Implement network-level access controls to restrict inbound connections to Coherence clusters to only trusted, internal systems; disable external access and require VPN or private network connectivity. Within 30 days: Complete upgrade to a patched Coherence version once vendor releases a fix, or decommission vulnerable instances and migrate to alternative solutions; test upgrades in non-production environments first.

Oracle Coherence EUVD-2026-46621

| CVE-2026-60215 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-rx36-7v95-hq8p

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated network TCP exploitation is easy and yields full takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H; scope unchanged as compromise is of Coherence itself.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:56 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Coherence is possible by unauthenticated remote attackers over TCP, per Oracle's July 2026 Critical Patch Update (CVE-2026-60215). The flaw in the Core component carries a CVSS 3.1 score of 9.8 and affects Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, delivering full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and it is not on CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform bundled with Oracle Fusion Middleware, used to scale stateful Java applications across clustered nodes. Cluster members and clients communicate over Coherence's TCP-based protocols (Coherence*Extend / TCMP), which historically deserialize Java objects transmitted between nodes - a common root cause for grid-product takeover bugs (CWE-502 Deserialization of Untrusted Data is the typical class here, though the CVE lists CWE as N/A). The affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence:*, and the vulnerability sits in the 'Core' component, meaning the exposure is in the foundational grid/networking layer rather than an optional add-on. Because the network listeners can be reachable without authentication in many deployments, an attacker who can reach a Coherence port can drive the vulnerable code path directly.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for each affected line - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; exact patched build/bundle-patch numbers are enumerated in that advisory and should be pulled directly from Oracle rather than assumed (Patch available per vendor advisory). Until patching is complete, restrict network reachability of Coherence TCMP and Coherence*Extend listener ports to trusted cluster members only via firewall/security-group rules, and avoid exposing any Coherence port to untrusted or internet-facing networks - the trade-off is that overly aggressive filtering can break legitimate client-to-cluster or node-to-node traffic, so scope rules to known member IPs. Where supported, enable TLS/SSL and authentication on Coherence*Extend proxies and configure serialization filtering (POF or JDK deserialization allow-lists) to limit the deserialization attack surface; note that enabling strict serialization filters may reject legitimate object types and requires testing.