A critical remote vulnerability in Oracle Coherence lets an unauthenticated attacker fully compromise the product over the network, scoring a maximum-severity 9.8 CVSS.
What Is It
CVE-2026-60300 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. According to Oracle's advisory, the flaw is "easily exploitable" and allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence. A successful attack can result in complete takeover of the product.
The CVSS 3.1 base score is 9.8 (CRITICAL), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low attack complexity, no privileges or user interaction required, and high impact to confidentiality, integrity, and availability.
Why It Matters
The combination of network reachability, no authentication requirement, low complexity, and full compromise makes this among the most severe classes of vulnerability. An attacker needs only TCP access to a vulnerable instance to take it over entirely, with impacts spanning data theft, tampering, and service disruption. Oracle Coherence is widely deployed as an in-memory data grid within enterprise Fusion Middleware environments.
What's Vulnerable
Per the NVD record, the affected supported versions of Oracle Coherence are:
- 12.2.1.4.0
- 14.1.1.0.0
- 14.1.2.0.0
- 15.1.1.0.0
Patch Status
This CVE was assigned by Oracle ([email protected]) and is addressed in the Oracle Critical Patch Update of July 2026. Administrators should apply the fixes referenced in that advisory. At the time of this record, the vulnerability status in NVD is "Received," and no CISA KEV entry was supplied, so there is no confirmed evidence of active exploitation in the provided source material.
Sources
- Oracle Critical Patch Update Advisory; July 2026: https://www.oracle.com/security-alerts/cpujul2026.html
- NVD, CVE-2026-60300: https://nvd.nist.gov/vuln/detail/CVE-2026-60300