What is the CVSS score of EUVD-2026-46701?

EUVD-2026-46701 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by EUVD-2026-46701?

Oracle Coherence, a core caching component of Oracle Fusion Middleware, contains a critical vulnerability (CVE-2026-60286, CVSS 9.8) allowing complete remote server compromise without authentication…

How to fix or mitigate EUVD-2026-46701?

Within 24 hours, inventory all Oracle Coherence deployments (affected versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) and immediately restrict network access to HTTP/ports used by Coherence to trusted internal networks only; disable any internet-facing or DMZ-exposed Coherence interfaces. Within 7 days, enable verbose logging and monitoring across all Coherence instances to detect exploitation patterns, deploy Web Application Firewall rules to block malformed HTTP requests to Coherence, and begin testing upgrade paths to newer unaffected versions in staging environments. Within 30 days, monitor Oracle's security advisories for patch release announcements, validate and deploy patches immediately upon availability, or execute tested version upgrades if interim controls prove operationally insufficient.

Oracle Coherence EUVD-2026-46701

| CVE-2026-60286 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-g5vw-99jg-h3pq

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated HTTP-reachable, easily exploitable takeover, so AV:N/AC:L/PR:N/UI:N with full C/I/A impact and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:29 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Coherence (Oracle Fusion Middleware, Core component) allows a remote, unauthenticated attacker to take over the affected server via a crafted HTTP request, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable,' affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. There is no public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

Oracle Coherence is an in-memory data grid / distributed caching and clustering platform bundled with Oracle Fusion Middleware, commonly used to scale Java (WebLogic) applications with a shared, replicated data tier. This issue resides in the 'Core' component and is reachable over HTTP by an unauthenticated network client, and Oracle states successful attacks result in full 'takeover' of Coherence - language Oracle typically reserves for arbitrary code execution or complete control of the product. No CWE was supplied (CWE: N/A) and Oracle's CPU advisories do not disclose root-cause detail, but Coherence's historical HTTP-exposed vulnerability class has centered on unsafe deserialization of untrusted data in its cluster/management protocols; that root cause is inferred here, not confirmed. The tag 'Information Disclosure' appears in the source intelligence but conflicts with the CVSS vector, which indicates high impact across all three of confidentiality, integrity, and availability rather than disclosure alone.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPUs ship as cumulative patches per Fusion Middleware release train, so patch each affected line - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - to the CPU-corresponding build (Patch available per vendor advisory; an exact standalone fix version was not provided in the input, confirm the specific patch number in the advisory's Coherence/Fusion Middleware patch table). Until patched, reduce exposure by restricting network access to Coherence HTTP/management and cluster ports so only trusted management hosts can reach them (trade-off: may break remote management/monitoring tooling), placing Coherence behind a segmented internal network or firewall and never exposing it directly to the internet or untrusted VLANs, and disabling any unused HTTP management/REST endpoints on the Coherence tier (trade-off: loss of REST-based administration or metrics). These are compensating controls only; the CPU patch is the sole complete fix.