CVE-2026-60214: Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Coherence executes to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Coherence access
CVE-2026-60214 is a high severity vulnerability in Oracle Coherence, a component of Oracle Fusion Middleware. It allows a low privileged attacker with access to the physical communication segment attached to the hardware running Oracle Coherence to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Coherence, potentially impacting additional products. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 base score is 8.7, indicating high impact on confidentiality and integrity. Oracle has published a Critical Patch Update advisory referencing this vulnerability but does not explicitly state patch availability or remediation details for Oracle Coherence in the provided content.
AI Analysis
Technical Summary
CVE-2026-60214 is a vulnerability in Oracle Coherence that allows a low privileged attacker with access to the physical communication segment of the hardware running Oracle Coherence to compromise the system. The vulnerability affects multiple supported versions of Oracle Coherence (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). Exploitation can result in unauthorized creation, deletion, or modification of critical data, with a scope change that may impact other Oracle products relying on Coherence. The CVSS 3.1 vector indicates the attack requires adjacent network access, low attack complexity, low privileges, no user interaction, and results in high confidentiality and integrity impacts but no availability impact. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly confirm patch availability or remediation level for Oracle Coherence in the provided excerpt.
Potential Impact
Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Coherence. This compromises confidentiality and integrity of data managed by Oracle Coherence and may affect additional Oracle products that depend on it. The vulnerability does not impact availability. The CVSS 3.1 base score of 8.7 reflects a high severity due to the potential for significant unauthorized data access and modification.
Mitigation Recommendations
Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities including this one. However, the provided advisory content does not explicitly confirm the availability of a patch or official fix for CVE-2026-60214 in Oracle Coherence. Customers are strongly recommended to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until an official fix is confirmed and applied, organizations should restrict physical and network access to the communication segments attached to Oracle Coherence hardware to mitigate risk.
CVE-2026-60214: Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Coherence executes to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Coherence access
Description
CVE-2026-60214 is a high severity vulnerability in Oracle Coherence, a component of Oracle Fusion Middleware. It allows a low privileged attacker with access to the physical communication segment attached to the hardware running Oracle Coherence to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Coherence, potentially impacting additional products. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 base score is 8.7, indicating high impact on confidentiality and integrity. Oracle has published a Critical Patch Update advisory referencing this vulnerability but does not explicitly state patch availability or remediation details for Oracle Coherence in the provided content.
CVSS v3.1
Score 8.7high
Affected software
pkg:maven/com.oracle.coherence/coherenceRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-60214 is a vulnerability in Oracle Coherence that allows a low privileged attacker with access to the physical communication segment of the hardware running Oracle Coherence to compromise the system. The vulnerability affects multiple supported versions of Oracle Coherence (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). Exploitation can result in unauthorized creation, deletion, or modification of critical data, with a scope change that may impact other Oracle products relying on Coherence. The CVSS 3.1 vector indicates the attack requires adjacent network access, low attack complexity, low privileges, no user interaction, and results in high confidentiality and integrity impacts but no availability impact. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly confirm patch availability or remediation level for Oracle Coherence in the provided excerpt.
Potential Impact
Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Coherence. This compromises confidentiality and integrity of data managed by Oracle Coherence and may affect additional Oracle products that depend on it. The vulnerability does not impact availability. The CVSS 3.1 base score of 8.7 reflects a high severity due to the potential for significant unauthorized data access and modification.
Mitigation Recommendations
Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities including this one. However, the provided advisory content does not explicitly confirm the availability of a patch or official fix for CVE-2026-60214 in Oracle Coherence. Customers are strongly recommended to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until an official fix is confirmed and applied, organizations should restrict physical and network access to the communication segments attached to Oracle Coherence hardware to mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:40.523Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fe6db9c2644c7f8cb0ec5
Added to database: 07/21/2026, 21:38:35 UTC
Last enriched: 07/30/2026, 04:43:31 UTC
Last updated: 09/05/2026, 10:52:10 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.