What is the CVSS score of EUVD-2026-46675?

EUVD-2026-46675 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Coherence EUVD-2026-46675

| CVE-2026-60260 MEDIUM

Information Exposure (CWE-200)

2026-07-21 oracle

GHSA-2qm5-8w93-25r5

Information Disclosure Oracle Oracle Coherence Oracle Corporation

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-exploitable unauthenticated HTTP bypass with partial read impact only; no integrity or availability impact applies per description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:12 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthenticated remote read access in Oracle Coherence's Core component allows network attackers to retrieve a subset of data via HTTP without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable network access with no authentication barrier, consistent with the 'Authentication Bypass' tag applied to this CVE. All four current supported release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are affected; no public exploit or confirmed active exploitation has been identified at time of analysis.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform within Oracle Fusion Middleware, widely used in enterprise Java deployments for session management, distributed data storage, and high-availability caching. The vulnerability resides in the Core component, which governs fundamental data-access operations including the product's HTTP-based management or data-access interface. The 'Authentication Bypass' tag suggests the HTTP interface fails to enforce authentication for certain requests or data endpoints, allowing direct data retrieval without valid credentials. No CWE is formally assigned by Oracle; however, the bypass pattern is consistent with CWE-287 (Improper Authentication) or CWE-306 (Missing Authentication for Critical Function). The CPE string cpe:2.3:a:oracle_corporation:oracle_coherence identifies the affected product as Oracle Corporation's Oracle Coherence across all four impacted version branches.

RemediationAI

Apply the patches issued in the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle's CPU format does not publish explicit patch version identifiers in the public advisory; organizations should consult My Oracle Support (MOS) for the specific patch IDs applicable to each release line (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). As a compensating control prior to patching, restrict network access to Oracle Coherence HTTP ports using host-based or perimeter firewall rules, allowing only trusted internal hosts or application servers to reach the Coherence HTTP interface - this eliminates the unauthenticated network vector at the cost of requiring firewall policy changes and possible management access restrictions. Do not expose Oracle Coherence HTTP endpoints directly to internet-facing networks regardless of patch status.