CVE-2026-60283

Analyzed Analyzed - Analysis Complete

Unauthenticated Data Read in Oracle Coherence

Publication date: 2026-07-21

Last updated on: 2026-07-24

Assigner: Oracle

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-24

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60283

EUVD

EUVD-2026-46698

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	coherence	12.2.1.4.0
oracle	coherence	14.1.1.0.0
oracle	coherence	14.1.2.0.0
oracle	coherence	15.1.1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Coherence, a middleware product. It allows an unauthenticated attacker to remotely access the system via HTTP and read some of its data. The impact is limited to unauthorized data access without affecting integrity or availability.

Detection Guidance

Detection requires checking for Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 exposed via HTTP. Verify if the service is running and accessible without authentication. Use network scanning tools like nmap to identify open ports and services. Check application logs for unusual HTTP requests targeting Coherence endpoints.

Impact Analysis

If you use affected versions of Oracle Coherence, an attacker could exploit this to read sensitive data stored in the system. This may include business or user information depending on what the Coherence instance manages.

Compliance Impact

This vulnerability allows unauthorized read access to a subset of Oracle Coherence data, which could lead to exposure of sensitive information. This may impact compliance with GDPR (data confidentiality requirements) and HIPAA (protected health information safeguards) if exploited.

Mitigation Strategies

Apply the latest security patches from Oracle for affected Oracle Coherence versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). If patches are unavailable, restrict network access to Oracle Coherence via HTTP using firewalls or network segmentation.

Hi! I’m here to help you understand CVE-2026-60283. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70