Description
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Oracle Coherence allows an unauthenticated attacker who can reach the service over HTTP to take complete control of the Coherence instance. The vulnerability can be exploited with little effort, leading to full compromise of confidentiality, integrity, and availability. The CVSS vector indicates that confidentiality, integrity, and availability are all high impact, and the base score is 9.8.

Affected Systems

Vendor Oracle Corporation's Coherence product is affected in versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0.

Risk and Exploitability

With a CVSS score of 9.8, the weakness is critical. The EPSS score is under 1%, suggesting that current exploitation activity is low, but the potential damage is catastrophic. The vulnerability is not listed in the CISA KEV catalog, yet the attack requires only network access to the vulnerable HTTP endpoint and no authentication, making it likely to be leveraged once discovered.

Generated by OpenCVE AI on July 28, 2026 at 22:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor-provided security patch for Oracle Coherence version 14.1.x or 15.1.x as soon as it becomes available
  • If a patch is not immediately available, restrict network access to the Coherence HTTP endpoint to trusted hosts or IP ranges to reduce exposure
  • Consider disabling or removing the unsecured HTTP interface if it is not required for your deployment; support only secure communication channels

Generated by OpenCVE AI on July 28, 2026 at 22:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Exploit Enables Full Compromise of Oracle Coherence via HTTP

Fri, 24 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Exploit Enables Full Compromise of Oracle Coherence via HTTP
Weaknesses CWE-284
CWE-285

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle coherence
CPEs cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:14.1.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:15.1.1.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle coherence
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Coherence
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T15:45:17.744Z

Reserved: 2026-07-08T15:51:40.524Z

Link: CVE-2026-60232

cve-icon Vulnrichment

Updated: 2026-07-23T15:45:12.103Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-28T23:00:07Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-285

    Improper Authorization

  • CWE-306

    Missing Authentication for Critical Function