CVE-2026-60210 Overview
CVE-2026-60210 is a missing authentication vulnerability [CWE-306] in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via TCP to fully compromise the affected server. Successful exploitation results in complete takeover of Oracle Coherence, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the Oracle Security Alert July 2026. Affected supported versions are 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Critical Impact
Unauthenticated remote attackers can take over Oracle Coherence over TCP with low complexity and no user interaction.
Affected Products
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE CVE-2026-60210 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60210
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used for distributed caching, session storage, and stateful application data across Oracle Fusion Middleware deployments. Cluster members and clients communicate over TCP using Coherence Extend and cluster protocols. This vulnerability exposes the Core component to unauthenticated attackers who can reach these TCP listeners on the network.
Because authentication is not enforced on the exposed interface [CWE-306], an attacker can interact with the service as if they were a legitimate participant. Coherence clusters frequently process serialized objects and management commands, so the impact extends to full takeover of the Coherence instance and any data it holds. The vulnerability affects confidentiality, integrity, and availability equally.
Root Cause
The root cause is missing authentication for a critical function [CWE-306] in the Coherence Core component. Requests reaching the affected TCP endpoint are processed without verifying the identity or authorization of the caller, allowing attackers to invoke privileged operations directly.
Attack Vector
Exploitation requires only network reachability to a Coherence TCP listener. No credentials, no user interaction, and no elevated privileges are needed. In typical deployments, Coherence ports are exposed to internal application tiers, so an attacker who lands in an adjacent segment or compromises a low-privilege application host can pivot to Coherence takeover.
No verified public proof-of-concept code is available at publication time. Refer to the Oracle Security Alert July 2026 for vendor-provided technical details.
Detection Methods for CVE-2026-60210
Indicators of Compromise
- Unexpected TCP connections to Coherence cluster ports (default TCMP and Extend proxy listeners) from hosts outside the known cluster or client inventory.
- New or modified Coherence cache entries, invocation service calls, or MBean operations that do not correlate with legitimate application activity.
- Java process anomalies on Coherence nodes, including unexpected child processes, outbound network connections, or class loading from non-standard paths.
Detection Strategies
- Baseline Coherence node behavior and alert on deviations in inbound TCP peers, JMX activity, and deserialization patterns.
- Inspect Coherence and WebLogic logs for unauthenticated invocation attempts, malformed cluster join requests, and repeated connection resets.
- Correlate network flow data with the authorized cluster membership list to surface rogue participants.
Monitoring Recommendations
- Enable verbose logging on Coherence proxy services and forward events to a centralized SIEM for retention and correlation.
- Monitor the Coherence host for unexpected outbound connections, which may indicate post-exploitation command-and-control.
- Track file integrity on Coherence configuration files (tangosol-coherence-override.xml, cache-config.xml) for unauthorized changes.
How to Mitigate CVE-2026-60210
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update for Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 as documented in the Oracle Security Alert July 2026.
- Restrict network access to Coherence TCP ports so that only authorized cluster members and application servers can reach them.
- Audit existing Coherence deployments for unauthorized cluster members or unexpected cache and invocation activity.
Patch Information
Oracle addressed CVE-2026-60210 in the July 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the Oracle Security Alert July 2026 for each affected Coherence version.
Workarounds
- Place Coherence clusters on isolated network segments and enforce firewall rules that block untrusted TCP sources.
- Enable Coherence identity and access controls, including SSL/TLS for cluster and Extend communication, until patches are applied.
- Disable or restrict any Coherence Extend proxy services that are not required by production workloads.
# Example: restrict Coherence cluster and Extend proxy ports to trusted subnets
iptables -A INPUT -p tcp --dport 9099 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 20000:20100 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP
iptables -A INPUT -p tcp --dport 20000:20100 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
