A critical, unauthenticated vulnerability in Oracle Coherence lets attackers take over affected systems over the network, and it carries a maximum-tier CVSS score of 9.8.
What Is It
CVE-2026-60280 is a critical flaw in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. According to Oracle's advisory, the vulnerability is "easily exploitable" and allows an unauthenticated attacker with network access via HTTP/2 to compromise Oracle Coherence. A successful attack can result in full takeover of the product. It carries a CVSS 3.1 base score of 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low complexity, no privileges, and no user interaction required.
Why It Matters
This is about as severe as a vulnerability gets. No authentication and no user interaction are needed, the attack traverses the network over HTTP/2, and the impact spans all three pillars; high confidentiality, integrity, and availability. Because success yields complete takeover of Oracle Coherence, any exposed and unpatched instance represents a direct path to compromise of the underlying middleware environment.
What's Vulnerable
The affected product is Oracle Coherence (vendor: Oracle Corporation) within Oracle Fusion Middleware. The supported versions listed as affected are:
- 14.1.1.0.0
- 14.1.2.0.0
- 15.1.1.0.0
Patch Status
The vulnerability is addressed in Oracle's July 2026 Critical Patch Update. Organizations running any of the affected versions should apply the fixes from that Critical Patch Update without delay, given the maximum-severity rating and the ease of exploitation. No CISA KEV entry accompanies the supplied material, so active exploitation is not confirmed here.
Sources
- Oracle Critical Patch Update Advisory, July 2026, https://www.oracle.com/security-alerts/cpujul2026.html
- NVD, CVE-2026-60280, https://nvd.nist.gov/vuln/detail/CVE-2026-60280