CVE-2026-60271 Oracle CVE debrief

Who should care

System administrators and security teams responsible for Oracle Coherence installations should prioritize patching this vulnerability to prevent potential takeovers. They should review and update access controls to limit logon access to Oracle Coherence infrastructure and monitor Oracle Coherence installations for any suspicious activity.

Technical summary

The vulnerability is located in the Core component of Oracle Coherence, a product of Oracle Fusion Middleware. The affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a high impact on confidentiality, integrity, and availability. The vulnerability can be easily exploited by low-privileged attackers with logon access to the infrastructure where Oracle Coherence executes. Successful attacks can result in the takeover of Oracle Coherence.

Defensive priority

High priority should be given to patching this vulnerability due to its high CVSS score and potential for exploitation.

Recommended defensive actions

• Apply the patches provided by Oracle as soon as possible
• Review and update access controls to limit logon access to Oracle Coherence infrastructure
• Monitor Oracle Coherence installations for any suspicious activity
• Consider implementing compensating controls, such as additional authentication or authorization mechanisms
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-21T22:17:29.350Z and last modified on 2026-07-27T20:25:51.360Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS score is 7.8, indicating a high severity. The vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability allows low-privileged attackers with logon access to compromise Oracle Coherence, potentially leading to takeover.

Official resources