CVE-2026-60237

Analyzed Analyzed - Analysis Complete

Unauthenticated Data Read in Oracle Coherence

Publication date: 2026-07-21

Last updated on: 2026-07-24

Assigner: Oracle

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-24

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60237

EUVD

EUVD-2026-46652

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	coherence	12.2.1.4.0
oracle	coherence	14.1.1.0.0
oracle	coherence	14.1.2.0.0
oracle	coherence	15.1.1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Coherence, a middleware product. It allows an unauthenticated attacker with network access to read some data stored in Oracle Coherence without needing to log in. The attack is possible via TCP network access.

Detection Guidance

This vulnerability affects Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Detection involves checking if these versions are running on your system. Use commands like 'java -jar coherence.jar -version' or check service logs for Oracle Coherence processes. Monitor network traffic on TCP ports typically used by Coherence (default 7574, 8088, or custom ports). Ensure firewalls restrict unauthorized access to these ports.

Impact Analysis

An attacker could gain unauthorized access to sensitive data stored in Oracle Coherence, potentially exposing confidential information such as user details or application data.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR and HIPAA requirements for data confidentiality and protection. Organizations using affected Oracle Coherence versions may face compliance violations and legal consequences.

Mitigation Strategies

Apply the latest security patches from Oracle for affected Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Restrict network access to TCP ports used by Oracle Coherence to trusted sources only.

Hi! I’m here to help you understand CVE-2026-60237. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70