What is the CVSS score of EUVD-2026-46670?

EUVD-2026-46670 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by EUVD-2026-46670?

Oracle Coherence in Oracle Fusion Middleware is vulnerable to remote unauthenticated attacks that can cause service crashes and unauthorized data modification by any attacker with network access.

How to fix or mitigate EUVD-2026-46670?

Within 24 hours, inventory all Coherence instances in your Oracle Fusion Middleware environment and restrict TCP access to Coherence ports (typically 9000-9100) to authorized internal networks only via firewall rules or network segmentation. Within 7 days, coordinate with Oracle support to identify available workarounds or hardening configurations, and document the business criticality and data sensitivity of each Coherence deployment. Within 30 days, deploy intrusion detection signatures for CVE-2026-60255 exploitation attempts; maintain active monitoring of Oracle security advisories for patch release; establish rapid deployment procedures for patching once vendor releases a fix.

Oracle Coherence EUVD-2026-46670

| CVE-2026-60255 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-xq3g-p3r9-6xpv

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:41 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence as well as unauthorized update, insert or delete access to some of Oracle Coherence accessible data. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

AnalysisAI

Denial of service and data tampering in Oracle Coherence (Oracle Fusion Middleware, Core component) lets a remote unauthenticated attacker with TCP network access hang or repeatedly crash the in-memory data grid and perform unauthorized update, insert, or delete of some accessible data. Oracle rates it CVSS 3.1 8.2 and describes it as 'easily exploitable', reflecting no authentication and low attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.