SYS::ONLINE
Wasteland.
Briefs1481
Issues20
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-60308 2026-07-21

Oracle Coherence Hit by Critical Unauthenticated Takeover Flaw (CVE-2026-60308)

"Oracle disclosed a critical (CVSS 9.8) vulnerability in Oracle Coherence that lets an unauthenticated attacker take over the product over the network via HTTP."

Oracle disclosed a critical (CVSS 9.8) vulnerability in Oracle Coherence that lets an unauthenticated attacker take over the product over the network via HTTP.

What Is It

CVE-2026-60308 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. According to Oracle's advisory, the flaw is "easily exploitable" and allows an unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. A successful attack results in full takeover of the product.

The issue carries a CVSS 3.1 base score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no privileges, no user interaction, and low attack complexity, with high impact to confidentiality, integrity, and availability.

Why It Matters

The combination of network reachability, no authentication requirement, low complexity, and complete takeover puts this at the top of the severity scale. An attacker who can reach an exposed Coherence instance over HTTP can compromise it outright, with full impact across confidentiality, integrity, and availability. Oracle's own description characterizes exploitation as easy, underscoring the urgency for exposed deployments.

Note: The supplied CISA KEV entry is empty, so there is no confirmation of active exploitation in the source material at this time.

What's Vulnerable

Per the NVD record, the affected product is Oracle Coherence (component: Core), vendor Oracle Corporation. The supported versions listed as affected are:

Patch Status

Oracle addressed this vulnerability as part of its July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update advisory and apply the relevant fixes for affected Coherence versions. No separate remediation guidance is included in the supplied source material beyond the Oracle security alert.

Sources