What is the CVSS score of EUVD-2026-46674?

EUVD-2026-46674 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by EUVD-2026-46674?

Oracle Coherence (core Oracle Fusion Middleware component) is vulnerable to complete remote takeover by unauthenticated attackers over HTTP, with no vendor patch currently available.

How to fix or mitigate EUVD-2026-46674?

Within 24 hours, conduct complete asset inventory of all Oracle Coherence deployments including version numbers and network exposure. Within 7 days, restrict network access to Coherence instances through firewall rules limiting HTTP access to essential systems only and disable external-facing endpoints. Within 30 days, monitor Oracle security advisories for patch availability, implement enhanced logging and monitoring of all Coherence activity, and prepare emergency change management procedures for rapid deployment when patches become available.

Oracle Coherence EUVD-2026-46674

| CVE-2026-60259 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-3jjj-9mc3-6r5r

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated network HTTP access with low complexity and full takeover, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:39 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Coherence (Oracle Fusion Middleware Core component) is possible by a remote, unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 and Oracle rates it 'easily exploitable,' with successful attacks resulting in complete takeover of the Coherence instance (full confidentiality, integrity, and availability loss). No public exploit has been identified at time of analysis, but the low attack complexity and lack of authentication make it a high-priority patch.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform bundled with Oracle Fusion Middleware and WebLogic Server, used to scale stateful application data across clustered JVMs. The vulnerable 'Core' component is reachable over HTTP in this case; historically, Coherence takeover vulnerabilities have stemmed from unsafe Java deserialization of attacker-controlled data in cluster/extend and management endpoints. No CWE was supplied by the source (CWE: N/A), so the precise root-cause class cannot be confirmed, but a full-takeover, network-unauthenticated Fusion Middleware flaw of this profile is consistent with an insecure deserialization or remote-object-invocation weakness. CPE data confirms the affected product as cpe:2.3:a:oracle_corporation:oracle_coherence across all versions.

RemediationAI

Patch available per vendor advisory: apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; Oracle does not publish a standalone semantic fix version separate from the CPU, so track the specific CPU patch number for your release rather than an invented version string. Until the CPU can be applied, reduce exposure by restricting network access to Coherence Extend/management and cluster HTTP ports so they are reachable only from trusted application tiers (via firewall/segmentation or a reverse proxy allowlist) - trade-off: may break legitimate remote clients or cross-tier caching if not scoped carefully. Where Coherence deserialization is involved, enabling any available serialization filtering/allowlisting and disabling unused HTTP-exposed management endpoints further limits reach, at the cost of possible feature loss for management tooling. Validate cluster functionality in staging before rolling mitigations to production.