CVE-2026-60233 Detail

Nvd.Nist • July 22, 2026

This CVE record has recently been published to the CVE List and has been included within the NVD dataset.

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Coherence. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Oracle Coherence and Access Manager Disclosed Multiple vulnerabilities affecting Oracle Coherence and Oracle Access Manager have been disclosed. CVE-2026-60248 and CVE-2026-60295 are critical vulnerabilities in Oracle Coherence, allowing attackers to potentially take over the system. CVE-2026-60248 has a CVSS score of 9.3, while CVE-2026-60295 has a score of 8.5, indicating high risk. Both vulnerabilities require network access, with CVE-60248 allowing unauthenticated access. CVE-2026-60358, affecting Oracle Access Manager, has a CVSS score of 10.0, indicating a severe risk of remote code execution. All vulnerabilities were published on July 21, 2026, and Oracle has included them in its July 2026 Critical Patch Update advisory. However, the availability of patches for the affected versions is not confirmed. Organizations using these products are advised to monitor Oracle's channels for updates and apply patches promptly. 10 sources 71

Extracted Entities

CVE-2026-60233 Detail

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

IP Addresses (1)

Platforms (2)