What is the CVSS score of EUVD-2026-46686?

EUVD-2026-46686 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle Coherence are affected by EUVD-2026-46686?

Oracle Coherence versions 12.2.1.4.0 through 15.1.1.0.0 are vulnerable to local privilege escalation (CVE-2026-60271, CVSS 7.8) that permits authenticated users with host access to achieve complete…

How to fix or mitigate EUVD-2026-46686?

Within 24 hours, identify and inventory all systems running Oracle Coherence, documenting current version numbers against the affected list (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). Within 7 days, apply Oracle's July 2026 Critical Patch Update to all vulnerable instances beginning with non-production environments to validate application stability. Within 30 days, roll out patches to production Coherence deployments, complete post-deployment version verification, and document remediation status.

Oracle Coherence EUVD-2026-46686

| CVE-2026-60271 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 oracle

GHSA-mr8m-ww49-qwjv

Privilege Escalation Oracle Oracle Coherence Oracle Corporation

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Oracle states local logon with low privileges and easy exploitation (AV:L/AC:L/PR:L/UI:N), and successful attack yields full product takeover, so C/I/A all High with unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:35 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Coherence executes to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Local privilege-based takeover in Oracle Coherence (component: Core) allows a low-privileged attacker with logon access to the host where Coherence executes to fully compromise the product, yielding high confidentiality, integrity, and availability impact. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform bundled within Oracle Fusion Middleware, used to scale application state across clustered JVMs. The flaw resides in the 'Core' component per Oracle's advisory. Oracle did not assign a specific CWE (CWE: N/A) and, per its standard CPU disclosure practice, withholds technical root-cause detail; the vector (AV:L, local logon required, scope unchanged) combined with full C/I/A impact indicates a local privilege-escalation or process-takeover class weakness against the Coherence runtime rather than a remote network exposure. The single CPE (cpe:2.3:a:oracle_corporation:oracle_coherence) confirms the Coherence application itself is the affected product.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the authoritative source for the exact patch/bundle-patch numbers for each affected release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); Oracle does not publish a single fix version string here, so Patch available per vendor advisory. Because the attack requires local logon, the strongest compensating control until patching is to tightly restrict interactive and service-account access to hosts running Coherence - remove unnecessary local accounts, enforce least privilege on the Coherence OS user, and segregate Coherence servers from general-purpose or shared login hosts (trade-off: may disrupt admin/automation workflows that rely on shared access). Monitor local process and file activity around the Coherence JVM for anomalous behavior as a detective control.