CVE-2026-60263: High severity Oracle Oracle Coherence (Oracle Fusion Middleware) vulnerability
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Coherence (Oracle Fusion Middleware) - Coreto a version that resolves this vulnerability.Fixed in 14.1.1.0.0 - Upgrade
Upgrade
Oracle Coherence (Oracle Fusion Middleware) - Coreto a version that resolves this vulnerability.Fixed in 14.1.2.0.0 - Upgrade
Upgrade
Oracle Coherence (Oracle Fusion Middleware) - Coreto a version that resolves this vulnerability.Fixed in 15.1.1.0.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Systems running Oracle Coherence Core in supported versions 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 are affected when an attacker has network access to the service over TCP.
What does an attacker need to exploit this issue?
No authentication, privileges, or user interaction are required. An attacker only needs network access via TCP, and exploitation is described as easy.
What is the potential impact of successful exploitation?
Successful exploitation can provide unauthorized access to critical data or complete access to all data accessible through Oracle Coherence. The stated impact is confidentiality only; integrity and availability impacts are not listed.