CVE-2026-60284

{
  "id": "CVE-2026-60284",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T22:17:30.833",
  "lastModified": "2026-10-24T18:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Coherence accessible data as well as  unauthorized update, insert or delete access to some of Oracle Coherence accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Oracle Coherence de Oracle Fusion Middleware (componente: Core). Las versiones soportadas que están afectadas son 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 y 15.1.1.0.0. La vulnerabilidad fácilmente explotable permite a un atacante no autenticado con acceso a la red vía HTTP comprometer Oracle Coherence. Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado a datos críticos o acceso completo a todos los datos accesibles de Oracle Coherence, así como acceso no autorizado de actualización, inserción o eliminación a algunos de los datos accesibles de Oracle Coherence. Puntuación Base CVSS 3.1 de 8.2 (impactos en la Confidencialidad e Integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Oracle Coherence",
          "versions": [
            {
              "version": "12.2.1.4.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "14.1.1.0.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "14.1.2.0.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "15.1.1.0.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-23T19:22:36.745700Z",
          "id": "CVE-2026-60284",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2FF57C7A-92C9-4D71-A7B1-CC9DEFAA8193"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5FA64A1D-34F9-4441-857A-25C165E6DBB6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:coherence:14.1.2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4AB71307-08C4-421D-A091-FFCFA0DA23E6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:coherence:15.1.1.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "830DFE6F-B4A1-452F-8C16-1505B869E9D6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}