CVE-2026-60197 Overview
CVE-2026-60197 is a critical vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, specifically in the Core component. The flaw affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker with network access via TCP can exploit this weakness to fully compromise Oracle Coherence. The vulnerability is classified under [CWE-306: Missing Authentication for Critical Function]. Oracle addressed the issue in the July 2026 Critical Patch Update.
Critical Impact
Successful exploitation results in complete takeover of Oracle Coherence, including confidentiality, integrity, and availability of the data grid.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0, 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE CVE-2026-60197 published to NVD as part of the Oracle July 2026 Security Alert
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60197
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used for scalable caching and distributed computing across Oracle Fusion Middleware deployments. The vulnerability allows an unauthenticated remote attacker to compromise Coherence over TCP. Attackers do not need valid credentials or user interaction to reach the vulnerable code path. Successful exploitation yields full control of the Coherence node, including access to cached data and cluster operations.
The issue is mapped to [CWE-306: Missing Authentication for Critical Function], indicating that a sensitive Coherence operation is exposed without adequate authentication controls. Oracle Coherence typically runs on cluster and extend-proxy ports that services expose to internal networks, which broadens the attack surface when segmentation is weak.
The EPSS score is 0.486% with a percentile of 39.03 as of 2026-07-23. No public exploit code or CISA KEV listing is currently associated with this CVE.
Root Cause
The root cause is missing authentication on a critical Coherence function reachable over TCP. Because the vulnerable endpoint accepts requests without verifying identity, any actor able to reach the Coherence listener can invoke privileged operations. Oracle's advisory does not publish source-level details of the affected code path.
Attack Vector
The attack vector is network-based with low complexity and no privileges required. An attacker sends crafted TCP requests to an exposed Oracle Coherence port to trigger the vulnerable code path. Since Coherence often participates in trusted internal networks, an initial foothold on any reachable segment is sufficient to attempt exploitation.
No verified proof-of-concept code is publicly available. Refer to the Oracle July 2026 Security Alert for vendor-authoritative technical details.
Detection Methods for CVE-2026-60197
Indicators of Compromise
- Unexpected inbound TCP connections to Coherence cluster ports (default 7574) or extend-proxy ports from unknown sources.
- New or modified Coherence cache entries, MBean invocations, or cluster membership changes without a corresponding administrative change record.
- Java processes hosting Coherence spawning unexpected child processes such as shells, cmd.exe, or scripting interpreters.
Detection Strategies
- Baseline legitimate Coherence client sources and alert on TCP connections to Coherence listeners from IPs outside that baseline.
- Inspect Coherence and WebLogic logs for anomalous deserialization events, class-loading warnings, or authentication-related errors around the vulnerable ports.
- Correlate process telemetry from Coherence host servers with network events to identify post-exploitation activity such as reverse shells or lateral movement.
Monitoring Recommendations
- Enable verbose Coherence audit logging and forward it to a centralized SIEM for retention and correlation.
- Monitor for outbound connections from Coherence hosts to untrusted networks, which may indicate a successful takeover.
- Track file integrity on Coherence installation directories and JVM classpath locations to detect unauthorized modification.
How to Mitigate CVE-2026-60197
Immediate Actions Required
- Apply the fixes from the Oracle July 2026 Critical Patch Update to all affected Coherence versions.
- Restrict network exposure of Coherence cluster and extend-proxy ports to trusted management segments only.
- Inventory all Oracle Fusion Middleware deployments to confirm which nodes run affected Coherence versions.
Patch Information
Oracle released the fix in the July 2026 Critical Patch Update. Administrators should apply the patches for Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 following the guidance in the Oracle July 2026 Security Alert.
Workarounds
- Block TCP access to Coherence listener ports at network firewalls and host-based firewalls where patching cannot occur immediately.
- Enforce mutual TLS and Coherence access controllers between cluster members and clients to reduce unauthenticated exposure.
- Isolate Coherence clusters on dedicated VLANs and require jump-host access for administration until patches are deployed.
# Example: restrict access to Coherence cluster port with iptables
iptables -A INPUT -p tcp --dport 7574 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
