Critical Vulnerabilities in Oracle Coherence and Access Manager Disclosed

Feedly

Critical Vulnerabilities in Oracle Coherence and Access Manager Disclosed

First seen 23 Jul 2026, 05:20 UTC • •71.0

Article Content

1 / 14

Browse articles

ThreatCluster •July 24, 2026 at 04:34 UTC

•CVE-2026-60248 and CVE-2026-60295 allow potential takeover of Oracle Coherence.
•CVE-2026-60358 in Oracle Access Manager has a critical CVSS score of 10.0.
•Patches for the affected Oracle products are not yet confirmed.

Multiple vulnerabilities affecting Oracle Coherence and Oracle Access Manager have been disclosed. CVE-2026-60248 and CVE-2026-60295 are critical vulnerabilities in Oracle Coherence, allowing attackers to potentially take over the system. CVE-2026-60248 has a CVSS score of 9.3, while CVE-2026-60295 has a score of 8.5, indicating high risk. Both vulnerabilities require network access, with CVE-60248 allowing unauthenticated access. CVE-2026-60358, affecting Oracle Access Manager, has a CVSS score of 10.0, indicating a severe risk of remote code execution. All vulnerabilities were published on July 21, 2026, and Oracle has included them in its July 2026 Critical Patch Update advisory. However, the availability of patches for the affected versions is not confirmed. Organizations using these products are advised to monitor Oracle's channels for updates and apply patches promptly.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 94d ago How this analysis works

Timeline

2026-07-21

CVE-2026-60295 published

Vulnerability allows low privileged attackers to compromise Oracle Coherence, CVSS 8.5.

2026-07-21

CVE-2026-60248 published

Easily exploitable vulnerability in Oracle Coherence allows unauthenticated access, CVSS 9.3.

2026-07-21

CVE-2026-60358 published

Critical vulnerability in Oracle Access Manager allows remote code execution, CVSS 10.0.

2026-07-21

CVE-2026-60233 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-07-23

Oracle Critical Patch Update advisory released

Oracle included multiple vulnerabilities in its July 2026 advisory, patch status not confirmed.

radar.offseq.com

More articles in this cluster (13)

Threat Graph

12 entities, 29 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

DDoS
Zero-day Exploit
T1190 - Exploit Public-Facing Application

Organization (1)

Oracle

Vulnerability (4)

CVE-2026-60233
CVE-2026-60248
CVE-2026-60295
CVE-2026-60358

Affected Platform (4)

Oracle Access Manager
Oracle Coherence
Oracle Fusion Middleware
WebLogic

Relationships

CVE-2026-60233 targets Oracle Access Manager
CVE-2026-60233 targets Oracle Coherence
CVE-2026-60233 targets Oracle Fusion Middleware
CVE-2026-60233 targets WebLogic
CVE-2026-60248 targets Oracle Access Manager
CVE-2026-60248 targets Oracle Coherence
CVE-2026-60248 targets Oracle Fusion Middleware
CVE-2026-60248 targets WebLogic
CVE-2026-60295 targets Oracle Access Manager
CVE-2026-60295 targets Oracle Coherence
CVE-2026-60295 targets Oracle Fusion Middleware
CVE-2026-60295 targets WebLogic
CVE-2026-60358 targets Oracle Access Manager
CVE-2026-60358 targets Oracle Coherence
CVE-2026-60358 targets Oracle Fusion Middleware
CVE-2026-60358 targets WebLogic
DDoS targets Oracle Access Manager
DDoS targets Oracle Coherence
DDoS targets Oracle Fusion Middleware
DDoS targets WebLogic
Zero-day Exploit targets Oracle Access Manager
Zero-day Exploit targets Oracle Coherence
Zero-day Exploit targets Oracle Fusion Middleware
Zero-day Exploit targets WebLogic
T1190 - Exploit Public-Facing Application targets Oracle Access Manager
T1190 - Exploit Public-Facing Application targets Oracle Coherence
T1190 - Exploit Public-Facing Application targets Oracle Fusion Middleware
T1190 - Exploit Public-Facing Application targets WebLogic
CVE-2026-60233 related to Oracle

Following this threat?

Track Oracle and CVE-2026-60233 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

.NET Vulnerability CVE-2026-111497 Requires Immediate Action On October 25, 2026, Microsoft released out-of-band security updates for.NET addressing CVE-2026-111497, a vulnerability in the Brotli decompression algorithm that allows unauthorized attackers to elevate privileges over a network. The flaw affects.NET versions 8, 9, 10, and 11, particularly in applications that…

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…