CVE-2026-60209 Overview
CVE-2026-60209 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful exploitation results in complete takeover of the affected Coherence instance, impacting confidentiality, integrity, and availability.
The issue is classified under CWE-306: Missing Authentication for Critical Function. Oracle addressed the vulnerability in the Oracle Critical Patch Update July 2026.
Critical Impact
Unauthenticated remote attackers can take over Oracle Coherence servers over TCP, exposing distributed caches, cluster data, and any application relying on Coherence for state management.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60209 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60209
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used for distributed caching and clustered application state across Oracle Fusion Middleware deployments. CVE-2026-60209 resides in the Core component and is reachable over TCP without any authentication or user interaction. An attacker on the network path to a Coherence cluster port can send crafted traffic that leads to full compromise of the Coherence process.
The attack is low complexity and requires no privileges. Because Coherence typically runs with access to sensitive business data and application state, takeover of the process yields high impact against confidentiality, integrity, and availability. Attackers who gain code execution within a Coherence node inherit its cluster membership and can pivot to peer nodes, tampering with cached data or issuing commands recognized by cluster members.
The EPSS probability for this CVE is 0.486%, at the 39th percentile as of 2026-07-23. Public exploit code has not been observed, but Coherence has a history of deserialization and unauthenticated protocol flaws that are quickly weaponized after disclosure.
Root Cause
The root cause maps to CWE-306: Missing Authentication for Critical Function. A critical operation exposed by the Coherence Core component does not require the caller to authenticate before the operation is processed, so any TCP peer can invoke it directly.
Attack Vector
Exploitation occurs over the network via TCP against a listening Coherence port, commonly the cluster or extend proxy listener. The attacker does not need credentials, does not need to be on the same host, and does not need to trick a user. Any Coherence instance whose ports are reachable from an untrusted network segment is directly exposed.
See the Oracle Critical Patch Update July 2026 advisory for vendor-supplied technical details.
Detection Methods for CVE-2026-60209
Indicators of Compromise
- Unexpected inbound TCP connections to Coherence cluster or Extend proxy ports from hosts outside the expected cluster membership.
- Coherence JVM processes spawning child processes such as shells, cmd.exe, powershell.exe, or scripting interpreters.
- New or modified classes loaded at runtime by the Coherence JVM that do not originate from the deployment artifact.
- Outbound network connections from Coherence hosts to unknown external addresses following inbound TCP traffic.
Detection Strategies
- Monitor Coherence JVM process trees for anomalous child processes or unexpected reflection and class-loading activity.
- Alert on TCP connections to Coherence ports originating from IP ranges outside the cluster inventory and application tier.
- Inspect Coherence and WebLogic logs for authentication failures, malformed serialized payloads, and unusual cluster membership changes.
Monitoring Recommendations
- Baseline expected cluster peers and application clients per Coherence node, then alert on deviations.
- Forward Coherence, WebLogic, and host telemetry to a centralized analytics platform for correlation across the middleware tier.
- Track egress traffic from middleware subnets to identify post-exploitation command-and-control activity.
How to Mitigate CVE-2026-60209
Immediate Actions Required
- Apply the Oracle Critical Patch Update July 2026 to all Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 deployments.
- Inventory every Coherence node and confirm that cluster and Extend proxy ports are not exposed to untrusted networks or the internet.
- Review recent connection logs on Coherence hosts for suspicious TCP sessions prior to patching.
Patch Information
Oracle released fixes as part of the Oracle Critical Patch Update July 2026. Administrators should follow the Oracle-provided patch bundles matching their Coherence and Fusion Middleware version and validate cluster stability in a staging environment before production rollout.
Workarounds
- Restrict Coherence TCP ports to trusted cluster and application subnets using host firewalls, security groups, and network ACLs.
- Place Coherence clusters behind segmentation boundaries that block direct access from user, DMZ, or partner networks.
- Enable and enforce Coherence security features such as SSL for cluster and Extend traffic where supported by the deployed version.
- Decommission or isolate any Coherence instances that cannot be patched promptly.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
