What is the CVSS score of EUVD-2026-46679?

EUVD-2026-46679 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by EUVD-2026-46679?

Oracle Coherence in versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contains a CVSS 9.8 remote takeover vulnerability enabling unauthenticated attackers to achieve full compromise of affected…

How to fix or mitigate EUVD-2026-46679?

Within 24 hours, execute inventory of all systems running Oracle Coherence 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and map their network exposure; implement firewall rules immediately restricting HTTP/2 access to these instances to only approved internal systems. Within 7 days, enforce network segmentation isolating data-grid instances from untrusted networks, disable HTTP/2 protocol if business requirements permit, and establish detailed asset tracking for all affected Coherence deployments. Within 30 days, continuously monitor Oracle security advisories for patch availability, conduct testing of upgrade paths to patched or newer unaffected versions, and develop a prioritized remediation plan focusing first on instances handling sensitive data.

Oracle Coherence EUVD-2026-46679

| CVE-2026-60264 CRITICAL

Information Exposure (CWE-200)

2026-07-21 oracle

GHSA-gff8-6vmp-57qh

Information Disclosure Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor states easily exploitable, unauthenticated, network HTTP/2 access resulting in takeover, so AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H; scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:38 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) lets an unauthenticated attacker with only HTTP/2 network reachability fully compromise the affected data-grid instance. Supported versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity and availability impact. No public exploit has been identified at time of analysis and it is not in CISA KEV, but the easily exploitable, network-facing, unauthenticated nature makes this a top-priority patch.

Technical ContextAI

Oracle Coherence is Oracle's in-memory distributed data-grid / caching platform, part of the Oracle Fusion Middleware stack and frequently deployed alongside Oracle WebLogic Server for clustered, low-latency Java applications. The affected 'Core' component is reachable over HTTP/2, indicating the exposure lies in Coherence's network listener/protocol handling path rather than an application layer above it. No CWE was assigned in the source data, so the precise root-cause class is unconfirmed; however, unauthenticated 'takeover' over HTTP in a Java middleware product of this type is most commonly associated with unsafe deserialization or request-parsing flaws. The single affected CPE (cpe:2.3:a:oracle_corporation:oracle_coherence) confirms Oracle Coherence as the sole product in scope.

RemediationAI

Patch available per vendor advisory: apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to Oracle Coherence 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; consult that CPU for the exact patched build for your version, as no standalone fix version number is present in the source data. Until patching is complete, reduce exposure by restricting network access to the Coherence HTTP/2 listener so it is reachable only from trusted management/application subnets via network ACLs, firewall rules, or segmentation, and disable or firewall any Coherence HTTP/REST or Extend endpoints that are not required - with the trade-off that legitimate remote management or cross-tier clients relying on those endpoints will lose connectivity and must be re-scoped to the allowed networks. Because the flaw is unauthenticated, application-layer authentication cannot be relied on as a compensating control, so network isolation is the primary interim mitigation.