A critical flaw in Oracle Coherence lets an unauthenticated attacker take over the product over the network with no user interaction, scoring 9.8 on CVSS.
What Is It
CVE-2026-60232 is a vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. Per Oracle's advisory, it is an easily exploitable flaw that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful exploitation results in full takeover of the product. It carries a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning high impact to confidentiality, integrity, and availability.
Why It Matters
The combination of network attack vector, low attack complexity, no required privileges, and no user interaction makes this among the most severe classes of vulnerability. An attacker needs only HTTP access to a vulnerable instance to achieve complete compromise. Because Coherence is an in-memory data grid often deployed in the middleware tier of enterprise applications, a takeover can expose sensitive application data and disrupt availability across dependent services.
No CISA KEV entry was supplied for this CVE, so active exploitation is not confirmed at this time. The absence of KEV confirmation does not lower the underlying technical severity.
What's Vulnerable
The following supported versions of Oracle Coherence are affected:
- 14.1.1.0.0
- 14.1.2.0.0
- 15.1.1.0.0
The vulnerable component is identified by Oracle as "Core."
Patch Status
Oracle addressed this issue in its July 2026 Critical Patch Update. Administrators running any affected version should apply the fixes described in the Oracle Critical Patch Update Advisory (July 2026). Given the 9.8 severity and unauthenticated, network-based exploitability, patching should be prioritized. No CISA-mandated remediation deadline was included in the supplied source material.
Sources
- Oracle Critical Patch Update Advisory, July 2026, https://www.oracle.com/security-alerts/cpujul2026.html
- NVD, CVE-2026-60232, https://nvd.nist.gov/vuln/detail/CVE-2026-60232