The 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions of Coherence installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory.

  - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported     versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence.
    While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products     (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence.
    (CVE-2026-60217)

  - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported     versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence.
    Successful attacks of this vulnerability can result in takeover of Oracle Coherence. (CVE-2026-60225)

  - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third     Party Jars (Apache Log4j)). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0     and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Oracle Coherence accessible data.
    (CVE-2026-34481)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Coherence (July 2026 CPU)

medium Nessus Plugin ID 328968

Version 1.2

Version 1.1

Version 1.2 Jul 23, 2026, 8:43 AM CVSS metrics ("CVSSv3 score" set to 7.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N") CVSS metrics ("Cvssv4 score" set to 6.3) CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:P") CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 score source (changed from "CVE-2026-60217" to "CVE-2026-60308") CVSSv3 score source (changed from "CVE-2026-60217" to "CVE-2026-34481") CVSSv4 severity (based on CVE-2026-34481, severity decreased from "High" to "Medium") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" set to "Exploits are available") Plugin Feed: 202607230843
Version 1.1 Jul 22, 2026, 11:06 PM New Plugin Feed: 202607222306