CVE-2026-60262
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Vulnerability in Oracle Coherence (component: Core) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An unauthenticated attacker can remotely compromise the system via TCP.
Risk Assessment
Risk of full takeover of Oracle Coherence, potentially leading to loss of confidentiality, integrity and availability.
Recommendation
Apply the security patch provided by Oracle for affected versions immediately.
Other vulnerabilities in Oracle Coherence
See all- CVE-2026-83416Medium
Vulnerability in Oracle Fusion Middleware Oracle Coherence product (component: Core) affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low privileged attacker with network access via HTTP can cause a partial denial of service (partial DoS) of Oracle Coherence.
- CVE-2026-83415High
Vulnerability in Oracle Coherence (Oracle Fusion Middleware), component Core, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low-privileged authenticated attacker with HTTP network access can take over Oracle Coherence; the vulnerability is difficult to exploit. CVSS 3.1 Base Score 7.5.
- CVE-2026-83414Low
Vulnerability in Oracle Coherence (component: Core) affecting version 15.1.1.0.0. A difficult-to-exploit flaw allows a low-privileged attacker with local logon to gain unauthorized read access to a subset of Oracle Coherence accessible data.
- CVE-2026-83413Low
Vulnerability in Oracle Coherence (component: Core) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A difficult-to-exploit flaw allows a high-privileged attacker with local logon to gain unauthorized update, insert, or delete access to some Oracle Coherence accessible data.
- CVE-2026-83412High
Vulnerability in Oracle Coherence (Oracle Fusion Middleware), component Core, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low-privileged authenticated attacker with TCP network access can access data and create, delete, or modify data. CVSS 3.1 Base Score 8.1.
- CVE-2026-83411High
Vulnerability in Oracle Coherence (Core component) affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle Coherence.
- CVE-2026-83410High
Vulnerability in Oracle Coherence (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An easily exploitable flaw allows a low-privileged attacker with network access via multiple protocols to compromise Oracle Coherence.
- CVE-2026-83354Medium
Vulnerability in Oracle Fusion Middleware Oracle Coherence product (component: Core) affects version 15.1.1.0.0. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data or complete access to all Oracle Coherence accessible data, and attacks may impact additional products.
- CVE-2026-60308Critical
Vulnerability in Oracle Coherence (Core component) allows an unauthenticated attacker via HTTP to fully compromise the system. The attack is easy to perform.
- CVE-2026-60306Critical
Vulnerability in Oracle Coherence (Core component) allows an unauthenticated attacker via TCP to fully compromise the system. The attack is easy to perform.
Original NVD description (English source)
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).