CVE-2026-60239
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Vulnerability in Oracle Coherence (Core component) allows a low-privileged attacker via HTTP to gain unauthorized access to critical data and modify it. The attack impacts additional products (scope change).
Risk Assessment
The risk is critical (CVSS 9.6) – an attacker can read and modify all data in Oracle Coherence, potentially leading to data breaches and integrity violations.
Recommendation
Immediately apply the patch provided by Oracle for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Restrict HTTP access to trusted networks only.
Other vulnerabilities in Oracle Coherence
See all- CVE-2026-83416Medium
Vulnerability in Oracle Fusion Middleware Oracle Coherence product (component: Core) affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low privileged attacker with network access via HTTP can cause a partial denial of service (partial DoS) of Oracle Coherence.
- CVE-2026-83415High
Vulnerability in Oracle Coherence (Oracle Fusion Middleware), component Core, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low-privileged authenticated attacker with HTTP network access can take over Oracle Coherence; the vulnerability is difficult to exploit. CVSS 3.1 Base Score 7.5.
- CVE-2026-83414Low
Vulnerability in Oracle Coherence (component: Core) affecting version 15.1.1.0.0. A difficult-to-exploit flaw allows a low-privileged attacker with local logon to gain unauthorized read access to a subset of Oracle Coherence accessible data.
- CVE-2026-83413Low
Vulnerability in Oracle Coherence (component: Core) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A difficult-to-exploit flaw allows a high-privileged attacker with local logon to gain unauthorized update, insert, or delete access to some Oracle Coherence accessible data.
- CVE-2026-83412High
Vulnerability in Oracle Coherence (Oracle Fusion Middleware), component Core, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low-privileged authenticated attacker with TCP network access can access data and create, delete, or modify data. CVSS 3.1 Base Score 8.1.
- CVE-2026-83411High
Vulnerability in Oracle Coherence (Core component) affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle Coherence.
- CVE-2026-83410High
Vulnerability in Oracle Coherence (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via multiple protocols to compromise Oracle Coherence.
- CVE-2026-83354Medium
Vulnerability in Oracle Fusion Middleware Oracle Coherence product (component: Core) affects version 15.1.1.0.0. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data or complete access to all Oracle Coherence accessible data, and attacks may impact additional products.
- CVE-2026-60308Critical
Vulnerability in Oracle Coherence (Core component) allows an unauthenticated attacker via HTTP to fully compromise the system. The attack is easy to perform.
- CVE-2026-60306Critical
Vulnerability in Oracle Coherence (Core component) allows an unauthenticated attacker via TCP to fully compromise the system. The attack is easy to perform.
Original NVD description (English source)
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Coherence accessible data as well as unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).