What is the CVSS score of EUVD-2026-46630?

EUVD-2026-46630 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by EUVD-2026-46630?

Oracle Coherence, a foundational data-management component in Oracle Fusion Middleware, can be remotely compromised without authentication by any attacker with network access (CVSS 9.8).

How to fix or mitigate EUVD-2026-46630?

Within 24 hours, identify all systems running Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and map network exposure; implement firewall rules restricting TCP access to Coherence ports (default 7574) to authorized internal systems only. Within 7 days, complete enterprise-wide Coherence inventory, classify systems by criticality, establish direct contact with Oracle Support to track patch release status and timelines, and begin testing compensating controls in staging environments. Within 30 days, prepare a full remediation plan including patch deployment procedures and validation steps, execute patching immediately when Oracle releases vendor fixes, and evaluate architectural alternatives (data center relocation, legacy system retirement, platform migration) for any Coherence systems where patching timelines prove unacceptable.

Oracle Coherence EUVD-2026-46630

| CVE-2026-60224 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-j749-7gq4-6wpq

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated TCP-reachable, easily exploitable takeover, so AV:N/AC:L/PR:N/UI:N with full C/I/A high and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:52 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (Core component of Oracle Fusion Middleware) allows an unauthenticated attacker with TCP network access to fully compromise the affected instance, per Oracle's July 2026 Critical Patch Update. The flaw carries a 9.8 CVSS and impacts confidentiality, integrity and availability of Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. No public exploit has been identified at time of analysis, but the network-reachable, no-authentication profile makes it a high-priority patch.

Technical ContextAI

Oracle Coherence is an in-memory data grid (IMDG) and distributed caching platform bundled with Oracle Fusion Middleware, used for clustering, session replication, and high-scale caching in Java/WebLogic application tiers. Cluster members and clients communicate over TCP (Coherence*Extend / TCMP), and the vulnerability resides in the product's Core component reachable over that network channel. Oracle did not assign a CWE (CWE: N/A), but 'takeover' by an unauthenticated network attacker in an IMDG of this type is historically consistent with unsafe Java deserialization of cluster/client traffic - a common root-cause class for prior Coherence and WebLogic critical flaws; this classification is inferred, not confirmed by Oracle.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for each affected Coherence release - Patch available per vendor advisory; Oracle did not publish a discrete fixed version string in the supplied data, so consult the CPU patch matrix for the exact patch/interim patch number matching your 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0 install. Until patched, restrict network exposure of Coherence cluster and Coherence*Extend proxy TCP ports to trusted management segments via firewall/security-group rules and keep Coherence tiers behind network segmentation rather than exposed to general or internet-facing traffic; the trade-off is that overly tight rules can break legitimate cluster membership (TCMP) or Extend client connectivity, so validate member/client reachability after changes. If the platform supports it, enable TLS/SSL and identity/authorization on Coherence*Extend proxies and TCMP to reduce untrusted access, accepting added latency and configuration overhead. These are compensating controls only - patching is the sole reliable fix.