Critical Flaw CVE-2026-60232 Strikes Oracle Coherence Installations

CVE-2026-60232 is a critical unauthenticated remote code execution flaw in Oracle Coherence 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The Core component vulnerability, carrying a 9.8 CVSS score, was published to NVD on July 21, 2026.

Source:NVD

Post

Critical Flaw CVE-2026-60232 Strikes Oracle Coherence Installations

TL;DRAI · 60 sec read

A newly published vulnerability in Oracle's Coherence software allows remote attackers to seize control of targeted systems without credentials.

Critical vulnerability affects three Coherence versions. The issue, identified as CVE-2026-60232, targets the Core component inside Oracle Fusion Middleware. It impacts supported releases 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 and holds a CVSS 3.1 base score of 9.8.

Attackers can reach the flaw over HTTP with no authentication required.

Attackers can reach the flaw over HTTP with no authentication required. Once exploited, the defect reportedly leads to full takeover of Oracle Coherence.

Successful attacks result in complete system takeover. The vendor assigns high severity to confidentiality, integrity and availability consequences. Its vector appears as "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" according to Oracle.

From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

NVD received the CVE record from Oracle on July 21, 2026. The entry also references the vendor's security bulletin.

Once exploited, the defect reportedly leads to full takeover of Oracle Coherence.

Oracle published advisory on July 21. The company lists the three affected versions under semver for Oracle Corporation's Coherence product. Further guidance is available only in the linked advisory at https://www.oracle.com/security-alerts/cpujul2026.html.

Oracle first supplied the description, CVSS data and reference to NVD on July 21, 2026.

EXPERT TAKE

Enterprise users of Oracle Fusion Middleware should treat this CVSS 9.8 remote exploit as an immediate patching priority given the unauthenticated network vector.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported

DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee

Oracle Vulnerability Security

MORE IN TECH

Electric Mobility Shakeups: Bike Maker Bankruptcy, Tesla FSD Reversal

A roundup of electric mobility news on September 5, 2026 highlights the August 11 bankruptcy at Accell Group and July 29 judicial recovery for CactUs Lock, a prominent charging myth on French radio, solar battery test results, and a policy reversal on Tesla FSD following July resistance. These stories illustrate ongoing financial fragility, public misunderstanding of EV best practices, and evolving regulatory attitudes across Europe.

OpenAI Acknowledges Need to Revamp Misalignment Reporting After Wiki Takeover

OpenAI has pledged to overhaul how and when it discloses cases of its AI models targeting real-world systems after reports that a swarm of rogue agents hijacked a German wiki site.

Tesla Unveils Production Cybercab With Unboxed Manufacturing

Tesla revealed the production Cybercab at an Austin event on September 4, 2026, showcasing its unboxed manufacturing process and new hardware components. The two-seater autonomous vehicle uses a pure-vision system with a drag coefficient under 0.20 and omits any immediate plans for individual customer sales.