CVE-2026-60305

{"id": "CVE-2026-60305", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-60305", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T18:44:55.852566Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "Oracle Coherence", "versions": [{"status": "affected", "version": "12.2.1.4.0", "versionType": "semver"}, {"status": "affected", "version": "14.1.1.0.0", "versionType": "semver"}, {"status": "affected", "version": "14.1.2.0.0", "versionType": "semver"}, {"status": "affected", "version": "15.1.1.0.0", "versionType": "semver"}]}]}], "published": "2026-07-21T22:17:33.153", "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2026.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Coherence accessible data as well as unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Coherence de Oracle Fusion Middleware (componente: Core). Versiones compatibles que est\u00e1n afectadas son 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 y 15.1.1.0.0. Vulnerabilidad f\u00e1cilmente explotable permite a un atacante con pocos privilegios con acceso a la red v\u00eda TCP comprometer Oracle Coherence. Ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado de creaci\u00f3n, eliminaci\u00f3n o modificaci\u00f3n a datos cr\u00edticos o a todos los datos accesibles de Oracle Coherence, as\u00ed como acceso de lectura no autorizado a un subconjunto de datos accesibles de Oracle Coherence. Puntuaci\u00f3n Base CVSS 3.1 de 7.1 (Impactos en Confidencialidad e Integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N)."}], "lastModified": "2026-10-24T18:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2FF57C7A-92C9-4D71-A7B1-CC9DEFAA8193"}, {"criteria": "cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5FA64A1D-34F9-4441-857A-25C165E6DBB6"}, {"criteria": "cpe:2.3:a:oracle:coherence:14.1.2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AB71307-08C4-421D-A091-FFCFA0DA23E6"}, {"criteria": "cpe:2.3:a:oracle:coherence:15.1.1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "830DFE6F-B4A1-452F-8C16-1505B869E9D6"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}