PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60264 Oracle CVE debrief

A critical vulnerability was discovered in Oracle Coherence, a product of Oracle Fusion Middleware. The vulnerability, tracked as CVE-2026-60264, has a CVSS 3.1 Base Score of 9.8, indicating a high impact on confidentiality, integrity, and availability. The affected versions are 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows unauthenticated attackers with network access via HTTP/2 to compromise the system. Successful attacks can result in a takeover of Oracle Coherence.

Vendor
Oracle
Product
Coherence
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-27
Advisory published
2026-07-21
Advisory updated
2026-07-27

Who should care

Organizations using Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 should prioritize patching this vulnerability to prevent potential takeovers. This is because the vulnerability has a high impact on confidentiality, integrity, and availability, and allows unauthenticated attackers to compromise the system.

Technical summary

The vulnerability in Oracle Coherence, tracked as CVE-2026-60264, allows unauthenticated attackers with network access via HTTP/2 to compromise the system. Successful attacks can result in a takeover of Oracle Coherence. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability affects Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Organizations should review their deployments and apply patches or updates provided by Oracle to prevent potential takeovers. This vulnerability has a high impact on confidentiality, integrity, and availability, with a CVSS 3.1 Base Score of 9.8.

Defensive priority

High

Recommended defensive actions

  • Apply patches or updates provided by Oracle to vulnerable versions of Oracle Coherence.
  • Implement compensating controls, such as network segmentation or access restrictions, to limit exposure.
  • Monitor systems for suspicious activity and implement incident response plans.
  • Conduct regular vulnerability assessments and inventory checks to identify potential vulnerabilities.
  • Consider implementing additional security measures, such as web application firewalls or intrusion detection systems.
  • Review and update incident response plans to address potential takeovers.
  • Verify that affected systems are properly patched and monitored for suspicious activity.

Evidence notes

The CVE record was published on 2026-07-21T22:17:28.490Z and was last modified on 2026-07-27T13:30:12.280Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 Base Score is 9.8, indicating a high impact on confidentiality, integrity, and availability. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:17:28.490Z and has not been modified since then. The NVD entry is currently Analyzed.