What is the CVSS score of EUVD-2026-46699?

EUVD-2026-46699 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Coherence are affected by EUVD-2026-46699?

Oracle Coherence (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) allows external attackers to remotely access and read sensitive business data without credentials, creating direct data…

How to fix or mitigate EUVD-2026-46699?

Within 24 hours, identify all systems running Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0; immediately restrict HTTP/network access via firewall rules to authorized internal systems only and segment affected systems from untrusted networks. Within 7 days, implement comprehensive logging and alerting for all connections to Coherence systems, deploy HTTP-layer filtering (WAF) to detect and block suspicious access patterns, and enable encryption in transit (TLS) for Coherence network communication where supported. Within 30 days, contact Oracle support to establish patch timeline, prepare isolated test environments for validation when patches become available, and develop a rollout plan prioritizing systems that process the most sensitive data; concurrently evaluate alternative distributed caching solutions to reduce dependence on vulnerable versions.

Oracle Coherence EUVD-2026-46699

| CVE-2026-60284 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-q65j-855g-vj3x

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Unauthenticated HTTP-reachable authentication bypass (AV:N/AC:L/PR:N/UI:N) yielding full data read (C:H) and limited modification (I:L), with no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:30 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data as well as unauthorized update, insert or delete access to some of Oracle Coherence accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle Coherence (Oracle Fusion Middleware Core component) lets an unauthenticated, network-based attacker read critical data and perform limited unauthorized modification over HTTP. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass, the flaw carries CVSS 8.2 (C:H/I:L) and affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it easily exploitable with no privileges required.

Technical ContextAI

Oracle Coherence is a Java-based in-memory data grid (distributed cache and computing platform) embedded in Oracle Fusion Middleware and used to scale and cluster application state, often behind WebLogic Server. The vulnerable 'Core' component is exposed over HTTP, and the 'Authentication Bypass' tag indicates the weakness allows an actor to reach protected data operations without valid credentials. No CWE was assigned in the source data, but the behavior (unauthenticated access to grid-managed data with high confidentiality and low integrity impact) is consistent with an improper authentication / missing access-control class of flaw. The single affected CPE, cpe:2.3:a:oracle_corporation:oracle_coherence, confirms Oracle Coherence itself as the target rather than a bundled third-party library.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update; patch availability is confirmed per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html, though the source data does not enumerate exact patched build numbers per branch, so consult the CPU matrix for the specific patch corresponding to your installed version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0). Because Oracle CPU patches are cumulative and periodic, prioritize scheduling given the unauthenticated network vector. As compensating controls until patching, restrict network access to Coherence's HTTP-exposed Core endpoints to trusted management/cluster subnets via firewall or security-group rules, place any Coherence-fronting HTTP listener behind an authenticating reverse proxy, and disable or bind cluster/management HTTP services to internal interfaces only - the trade-off is that overly aggressive network restriction can break legitimate cross-node cluster communication or management tooling, so validate against your topology before enforcing.