Description
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Coherence is vulnerable to an unauthenticated network attack that allows an attacker with TCP access to compromise the system; a successful exploit can lead to complete takeover of the affected Oracle Coherence instance, impacting confidentiality, integrity, and availability of the application and any data it manages. The issue is essentially an improper or missing authorization (CWE‑284) that allows unrestricted access through TCP, and the vulnerability is rated with a CVSS 3.1 Base Score of 9.8, indicating extremely high severity.

Affected Systems

Oracle Corporation’s Oracle Coherence product, specifically versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected.

Risk and Exploitability

The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation is currently unlikely, yet the high CVSS score and the ability to fully compromise the system make it a critical risk. The inferred attack vector is a direct TCP‑based unauthenticated connection to the Coherence service, requiring no special privileges or authentication to gain full control.

Generated by OpenCVE AI on August 4, 2026 at 04:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle Coherence patch as released by Oracle and documented in their security alerts.
  • Limit network exposure by configuring firewall rules or access control lists to allow only trusted hosts to reach the Coherence ports.
  • If a patch cannot be applied immediately, temporarily block external TCP traffic to the affected Coherence instances until remediation is completed.
  • Verify that Coherence configurations enforce proper authorization checks to prevent unauthorized TCP access.

Generated by OpenCVE AI on August 4, 2026 at 04:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated TCP Attack on Oracle Coherence Allows Complete Takeover

Thu, 30 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated TCP Attack on Oracle Coherence Allows Complete Takeover

Mon, 27 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle Coherence via Network Access
Weaknesses CWE-119
CWE-94

Fri, 24 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle Coherence via Network Access
Weaknesses CWE-119
CWE-94

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle coherence
CPEs cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:14.1.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:15.1.1.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle coherence
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Coherence
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T17:03:08.919Z

Reserved: 2026-07-08T15:51:40.524Z

Link: CVE-2026-60224

cve-icon Vulnrichment

Updated: 2026-07-23T16:24:45.585Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T04:45:03Z

Weaknesses