CVE-2026-60271

Received Received - Intake

Oracle Coherence Remote Code Execution

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Oracle

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Coherence executes to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-60271

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	coherence	12.2.1.4.0
oracle	coherence	14.1.1.0.0
oracle	coherence	14.1.2.0.0
oracle	coherence	15.1.1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Coherence, a middleware product. It allows a low-privileged attacker with local access to take over the system by exploiting a flaw in the Core component. The attack can lead to full compromise of Oracle Coherence, affecting confidentiality, integrity, and availability.

Impact Analysis

If you use Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0, an attacker with local access could take control of your system. This could lead to unauthorized data access, modification, or disruption of services running on Oracle Coherence.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations using affected versions must address this flaw to maintain compliance.

Mitigation Strategies

Apply the latest Oracle Coherence patches for affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Restrict user privileges to limit access to the infrastructure where Oracle Coherence executes. Monitor logs for suspicious activity related to Oracle Coherence processes.

Hi! I’m here to help you understand CVE-2026-60271. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70