PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60264 Oracle CVE debrief

A critical vulnerability was discovered in Oracle Coherence, a product of Oracle Fusion Middleware. The vulnerability, tracked as CVE-2026-60264, has a CVSS 3.1 Base Score of 9.8, indicating a high impact on confidentiality, integrity, and availability. The affected versions are 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows unauthenticated attackers with network access via HTTP/2 to compromise the system. Successful attacks can result in a takeover of Oracle Coherence.

Vendor
Oracle
Product
Coherence
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-27
Advisory published
2026-07-21
Advisory updated
2026-07-27

Who should care

Organizations using Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 should prioritize patching this vulnerability to prevent potential takeovers. This is because the vulnerability has a high impact on confidentiality, integrity, and availability, and allows unauthenticated attackers to compromise the system.

Technical summary

The vulnerability in Oracle Coherence, tracked as CVE-2026-60264, allows unauthenticated attackers with network access via HTTP/2 to compromise the system. Successful attacks can result in a takeover of Oracle Coherence. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability affects Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Organizations should review their deployments and apply patches or updates provided by Oracle to prevent potential takeovers. This vulnerability has a high impact on confidentiality, integrity, and availability, with a CVSS 3.1 Base Score of 9.8.

Defensive priority

High

Recommended defensive actions

  • Apply patches or updates provided by Oracle to vulnerable versions of Oracle Coherence.
  • Implement compensating controls, such as network segmentation or access restrictions, to limit exposure.
  • Monitor systems for suspicious activity and implement incident response plans.
  • Conduct regular vulnerability assessments and inventory checks to identify potential vulnerabilities.
  • Consider implementing additional security measures, such as web application firewalls or intrusion detection systems.
  • Review and update incident response plans to address potential takeovers.
  • Verify that affected systems are properly patched and monitored for suspicious activity.

Evidence notes

The CVE record was published on 2026-07-21T22:17:28.490Z and was last modified on 2026-07-27T13:30:12.280Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 Base Score is 9.8, indicating a high impact on confidentiality, integrity, and availability. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-60264 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-60264

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-60264 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-60264

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.