Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-60272 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Oracle Coherence. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique VNC (T1021.005); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-14 (Permitted Actions Without Identification or Authentication) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-46687
Vulnerability Data
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks…
more
of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
MITRE ATT&CK v20.0
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 6 hardening rules · 3 OS baselines
V6.2.3V6.4.4V10.4.16V12.1.3
Mitigating Controls (NIST 800-53 r5)
Our mappings, made for this CVE.
Directly mandates unique identification and authentication of users before access to functions requiring identity.
Extends the same authentication requirement to non-organizational users accessing critical functionality.
Requires authentication of services before they can invoke or expose critical functions.
Explicitly identifies and limits actions permitted without authentication, preventing critical functions from being exposed.
Access enforcement requires prior authentication before any authorization decision for critical functions.
Mitigating Controls (NIST CSF 2.0)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.
Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.
Managing identities and credentials is a prerequisite for authentication but does not itself enforce it on critical functions.
Defining and enforcing authorizations assumes prior authentication and therefore only partially mitigates the absence of authentication.
Protecting networks from unauthorized access can be undermined by missing authentication but does not address the root authentication gap.
Mitigating Controls (ISO/IEC 27001:2022 Annex A)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.
A.8.5 mandates that authentication be in place to substantiate claimed identity when access to systems, applications and services is granted, and CWE-306 is the absence of authentication for critical functions; applying A.8.5 where it was not applied before requires adding authentication, so the weakness stops being present with no remainder, analogous to A.8.24 -> CWE-311 = full.
A.8.29 explicitly tests authentication functions and combines code review, dynamic testing, and penetration testing that surface most missing-authentication flaws, while a bounded remainder remains in secondary channels, undisclosed binary components, and operational/post-deployment exposures that one test cycle may not enumerate.
A.8.3 mandates authentication for access to information and associated assets (explicit in the dynamic access management section: 'requiring authentication, appropriate credentials or a certificate'), so implementing it where it was not applied before adds authentication to critical functions that lacked it, removing most CWE-306 instances; the remainder is nameable — secondary channels that bypass the primary authentication path, debug/UART ports, and protocol-level gaps in OT/embedded systems where access restriction is enforced at a different layer than the clause reaches.
A.8.21 mandates authentication requirements for accessing network services and requires security measures (including authentication) to be identified and implemented, so applying it where it was not applied before results in authentication being added to network services that lacked it, removing those CWE-306 instances; however, A.8.21's scope is limited to network services while CWE-306 also covers non-network critical functions (UART debug ports, local APIs, backdoor channels), and the clause governs the requirement rather than directly implementing authentication, leaving a nameable remainder.
A.8.30 mandates contractual security requirements (point b referencing 8.25-8.29), acceptance testing (point d), and evidence of security capabilities (point e), which can require and verify that authentication is designed into outsourced deliverables before they ship — but it is a governance/oversight mechanism whose effect depends on the rigor of contract specification, acceptance test coverage, and developer compliance, so it prevents a slice rather than the bulk of instances.
A.8.8's reach is DISCLOSURE — it finds vulnerabilities that have been published as advisories. CWE-306 does commonly surface as CVEs (numerous examples in the observed examples section: CVE-2024-11680, CVE-2022-31260, CVE-2022-29951, etc.), so A.8.8 finds the disclosed minority of instances. However, most CWE-306 instances are design-level omissions that never receive CVE numbers — internal applications, undocumented interfaces, or 'by design' decisions that no external researcher reports — so the disclosed share is a minority of latent instances, capped at `partial` by the disclosure-reach rule.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over our cross-walk; rows rated `none` are excluded, and each rule says how its mapping was checked.
Definition changed on 29 October 2026. Until then this section listed every rule rated above none, partial included. From that date it lists rules whose mapping is rated full or mostly and checked at llm_unverified or higher; partial mappings show when you ask.
Oracle Linux 8 (2 partial rules)
- V-248585 OL 8 must require reauthentication when using the "sudo" command. blocks CWE-306
- V-248827 OL 8 must not have the rsh-server package installed. blocks CWE-306
RHEL 7 (1 rule, 1 more partial)
- V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. blocks CWE-306
- V-237635 The Red Hat Enterprise Linux operating system must require re-authentication when using the "sudo" command. blocks CWE-306
RHEL 8 (1 rule, 1 more partial)
- V-230492 RHEL 8 must not have the rsh-server package installed. blocks CWE-306
- V-237643 RHEL 8 must require re-authentication when using the "sudo" command. blocks CWE-306