What is the CVSS score of EUVD-2026-46704?

EUVD-2026-46704 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Coherence are affected by EUVD-2026-46704?

Oracle Coherence, a critical caching component embedded in Fusion Middleware (ERP, HCM, supply chain platforms), is vulnerable to complete remote takeover by unauthenticated attackers through HTTP.

How to fix or mitigate EUVD-2026-46704?

Within 24 hours: Inventory all Oracle Coherence instances by version, prioritize production systems, and immediately network-isolate affected deployments (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) using firewall rules restricting cluster and HTTP access to authorized internal sources only; disable direct internet-facing access. Within 7 days: Deploy logging and alerting for cluster state changes and cache access anomalies; establish documented failover and emergency isolation procedures with application teams; contact Oracle Support to confirm patch release timeline for your specific versions and request workaround guidance. Within 30 days: Apply vendor patch upon release or upgrade to patched versions; if no patch timeline is acceptable, execute planned migration to alternative caching solutions; validate all remediations in production-equivalent test environment and maintain current patch inventory.

Oracle Coherence EUVD-2026-46704

| CVE-2026-60289 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-xxhj-v997-pgq5

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms easily exploitable, remote, unauthenticated HTTP access with no user interaction and full product takeover, so AV:N/AC:L/PR:N/UI:N and C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:28 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover of Oracle Coherence (Fusion Middleware, Core component) is achievable by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable' against supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile and complete-compromise outcome make it a top-priority patch.

Technical ContextAI

Oracle Coherence is a distributed, in-memory data grid used within Oracle Fusion Middleware to provide clustered caching, session replication, and low-latency data services for enterprise Java (WebLogic/Fusion) applications. Coherence cluster and management endpoints commonly communicate over network protocols including HTTP, which is the stated attack surface here. The CWE is not provided by Oracle, so the precise root-cause class is unconfirmed; however, prior Coherence 'takeover' vulnerabilities have frequently involved unsafe deserialization of untrusted data reaching cluster/management endpoints, which is consistent with an unauthenticated network-to-code-execution outcome. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence, and the vulnerable component is identified as 'Core.'

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for your specific release train (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); Oracle delivers Coherence fixes as CPU patch bundles rather than a single tagged version, so use the CPU's Coherence patch matrix to select the correct bundle - patch available per vendor advisory, exact fix build per the CPU matrix. Until patched, reduce exposure by restricting network access to Coherence HTTP/management and cluster ports so they are reachable only from trusted management segments (this can break external management tooling or cross-tier access that legitimately uses those endpoints), disabling or firewalling any internet- or broadly-exposed Coherence HTTP listener, and, where deserialization is the suspected vector, enforcing Coherence/WebLogic serialization allowlists (POF or JEP-290-style filters), which may reject legitimate custom serialized types and require testing. Prioritize any Coherence instances whose HTTP endpoints are reachable from untrusted networks.