CVE-2026-60290

Analyzed Analyzed - Analysis Complete

Unauthenticated Remote Code Execution in Oracle Coherence

Publication date: 2026-07-21

Last updated on: 2026-07-27

Assigner: Oracle

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60290

EUVD

EUVD-2026-46705

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	coherence	14.1.1.0.0
oracle	coherence	14.1.2.0.0
oracle	coherence	15.1.1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a critical vulnerability in Oracle Coherence, a middleware product. It allows an unauthenticated attacker to remotely access and take over the system via HTTP without needing credentials. The flaw affects versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of Oracle Coherence. Inspect installed software versions on systems running Oracle Fusion Middleware. Look for versions 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0. Network scans can identify exposed HTTP endpoints that may be running these versions.

Impact Analysis

An attacker could exploit this to fully compromise Oracle Coherence, leading to loss of confidentiality, integrity, and availability of data. This could result in unauthorized access, data breaches, or system downtime.

Compliance Impact

This vulnerability could lead to violations of GDPR and HIPAA due to unauthorized data access or breaches. Organizations using affected versions may face legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update for Oracle Fusion Middleware immediately. If patching is not possible, restrict network access to Oracle Coherence via HTTP using firewalls or disable the service if not required. Monitor Oracle security advisories for updates.

Hi! I’m here to help you understand CVE-2026-60290. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70