CVE-2026-60309

{
  "id": "CVE-2026-60309",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T22:17:33.603",
  "lastModified": "2026-10-24T18:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Coherence executes to compromise Oracle Coherence.  Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Oracle Coherence de Oracle Fusion Middleware (componente: Core). Las versiones compatibles que están afectadas son 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 y 15.1.1.0.0. Una vulnerabilidad fácilmente explotable permite a un atacante no autenticado con acceso al segmento de comunicación físico conectado al hardware donde se ejecuta Oracle Coherence comprometer Oracle Coherence. Los ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de Oracle Coherence. Puntuación Base CVSS 3.1 de 8.8 (impactos en Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Oracle Coherence",
          "versions": [
            {
              "version": "12.2.1.4.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "14.1.1.0.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "14.1.2.0.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "15.1.1.0.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-23T18:37:13.791061Z",
          "id": "CVE-2026-60309",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2FF57C7A-92C9-4D71-A7B1-CC9DEFAA8193"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5FA64A1D-34F9-4441-857A-25C165E6DBB6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:coherence:14.1.2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4AB71307-08C4-421D-A091-FFCFA0DA23E6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:coherence:15.1.1.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "830DFE6F-B4A1-452F-8C16-1505B869E9D6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}