Description
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Oracle Coherence’s Core component, identified as CWE‑306, allows an attacker who already has a low‑privilege account and can reach the service over TCP to take full control of the Coherence service. The vulnerability can lead to loss of confidentiality, integrity, and availability and is rated CVSS 8.8 for its high impact.

Affected Systems

Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected; any installation of these versions exposed to a network is vulnerable.

Risk and Exploitability

The EPSS score is less than 1 %, and the flaw is not listed in CISA’s KEV catalog, indicating a low probability of mass exploitation. However, the network‑based attack vector requires only low privileges and therefore all exposed Coherence instances are at risk if the listed versions are in use.

Generated by OpenCVE AI on August 4, 2026 at 04:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle Coherence patch released in CPU July 2026 to update to a fixed version
  • If immediate patching is not possible, limit network exposure by placing the Coherence process behind a firewall or VPN that only allows trusted hosts
  • Validate that no other soft‑layer interposition (e.g., outdated authentication or access control) remains when the service runs

Generated by OpenCVE AI on August 4, 2026 at 04:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Title Oracle Coherence Remote Application Takeover via Low-Privilege TCP Attack

Sat, 01 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Title Low-Privilege TCP-Based Compromise of Oracle Coherence

Mon, 27 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege TCP-Based Compromise of Oracle Coherence

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle coherence
CPEs cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:14.1.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:15.1.1.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle coherence
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Coherence
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T16:43:15.509Z

Reserved: 2026-07-08T15:51:40.523Z

Link: CVE-2026-60218

cve-icon Vulnrichment

Updated: 2026-07-23T16:43:11.327Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T04:45:03Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function