Description
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Coherence is vulnerable to a remote code execution flaw that allows an unauthenticated attacker with network access via TCP to compromise the product. The vulnerability results in full takeover of Oracle Coherence, affecting confidentiality, integrity, and availability as stated by the CVSS 3.1 vector. The vulnerability exploits a missing authentication mechanism, leading to severe impact on systems that expose the relevant Coherence ports over a network.

Affected Systems

Affected systems include Oracle Corporation’s Oracle Coherence product for Fusion Middleware. The versions impacted are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 as listed in Oracle’s security alert. Older or newer releases are not reported to be affected according to the current CNA information.

Risk and Exploitability

The CVSS base score of 9.8 indicates critical severity, while the EPSS score of less than 1% shows a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can execute the flaw by connecting to the Coherence service over TCP without authentication, making it easily exploitable in open or poorly segmented networks.

Generated by OpenCVE AI on August 2, 2026 at 23:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle Coherence update from the July 2026 security alert to patch the remote code execution flaw
  • Configure the Coherence service to require authentication or disable unauthenticated access to reduce exposure
  • If an immediate upgrade is not feasible, block inbound network traffic to the Coherence service ports or restrict access to trusted hosts via firewall rules
  • Enforce strict network segmentation and limit exposure of Coherence components to internal networks to reduce the attack surface
  • Monitor system logs for unexpected connections or authentication attempts and investigate any anomalies promptly

Generated by OpenCVE AI on August 2, 2026 at 23:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Allows Remote Code Execution in Oracle Coherence

Sat, 01 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Title Oracle Coherence Remote Code Execution via Unauthenticated TCP Access
Weaknesses CWE-284
CWE-287

Fri, 24 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
Title Oracle Coherence Remote Code Execution via Unauthenticated TCP Access
Weaknesses CWE-284
CWE-287

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle coherence
CPEs cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:14.1.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:15.1.1.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle coherence
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Coherence
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T15:49:59.954Z

Reserved: 2026-07-08T15:51:40.524Z

Link: CVE-2026-60228

cve-icon Vulnrichment

Updated: 2026-07-23T15:49:54.993Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T23:30:07Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function