THE CIRCUITRYYour one-stop source for all tech news

Home/Tech/Critical Flaw CVE-2026-60232 Strikes Oracle Coherence Installations

VERIFIEDBy Xavier Rivera· ·1 min read

Critical Flaw CVE-2026-60232 Strikes Oracle Coherence Installations

CVE-2026-60232 is a critical unauthenticated remote code execution flaw in Oracle Coherence 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The Core component vulnerability, carrying a 9.8 CVSS score, was published to NVD on July 21, 2026.

Source:NVD

Post

Critical Flaw CVE-2026-60232 Strikes Oracle Coherence Installations

TL;DRAI · 60 sec read

A newly published vulnerability in Oracle's Coherence software allows remote attackers to seize control of targeted systems without credentials.

Critical vulnerability affects three Coherence versions. The issue, identified as CVE-2026-60232, targets the Core component inside Oracle Fusion Middleware. It impacts supported releases 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 and holds a CVSS 3.1 base score of 9.8.

Attackers can reach the flaw over HTTP with no authentication required.

Attackers can reach the flaw over HTTP with no authentication required. Once exploited, the defect reportedly leads to full takeover of Oracle Coherence.

Successful attacks result in complete system takeover. The vendor assigns high severity to confidentiality, integrity and availability consequences. Its vector appears as "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" according to Oracle.

From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

NVD received the CVE record from Oracle on July 21, 2026. The entry also references the vendor's security bulletin.

Once exploited, the defect reportedly leads to full takeover of Oracle Coherence.

Oracle published advisory on July 21. The company lists the three affected versions under semver for Oracle Corporation's Coherence product. Further guidance is available only in the linked advisory at https://www.oracle.com/security-alerts/cpujul2026.html.

Oracle first supplied the description, CVSS data and reference to NVD on July 21, 2026.

EXPERT TAKE

Enterprise users of Oracle Fusion Middleware should treat this CVSS 9.8 remote exploit as an immediate patching priority given the unauthenticated network vector.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported

DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee

Oracle Vulnerability Security

MORE IN TECH

AMD to invest up to $5B in Anthropic

AMD will invest up to $5 billion in Anthropic and supply up to 2 gigawatts of Instinct MI450 GPUs via its Helios system, with the first gigawatt arriving in the first half of 2027. The deal also launches a multi-year engineering collaboration that brings Claude into AMD’s development workflows.

Samsung debuts Galaxy Watch 9 and Galaxy Watch Ultra 2 featuring enhanced displays and FDA-cleared apnea tracking

Samsung introduced the Galaxy Watch 9 and Galaxy Watch Ultra 2 with displays up to 5,000 nits, larger batteries, FDA-cleared sleep apnea detection and fresh AI-driven wellness tools. The wearables emphasize preventive monitoring that includes trail-run analysis, dive-computer functions and remote support features, with sales beginning next month.

Samsung debuts its first wide-body foldable in 2026 Galaxy Z8 lineup

Samsung revealed its first wide-body foldable as part of a three-model 2026 Galaxy Z8 family that also includes the Z Fold 8 Ultra, a thinner Z Flip 8, and two smartwatches. Larger batteries, faster charging, and the Snapdragon 8 Elite Gen 5 chipset arrive with higher prices caused by component shortages; devices go on sale August 7.