CVE-2026-60248

CriticalCVSS 9.3

Published: 21/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

Vulnerability in Oracle Coherence (Core component) allows an unauthenticated attacker with logon to the infrastructure to take over the product. Attacks may impact additional products (scope change).

Risk Assessment

Successful attack can lead to full takeover of Oracle Coherence, threatening confidentiality, integrity, and availability of data across the infrastructure.

Recommendation

Apply the patch provided by Oracle for affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). Restrict access to the infrastructure to trusted users only.

Original NVD description (English source)

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Coherence executes to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).