CVE-2026-60211: Oracle Coherence Privilege Escalation

CVE-2026-60211 Overview

CVE-2026-60211 is a high-severity vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw enables an unauthenticated attacker with access to the adjacent physical communication segment to compromise Oracle Coherence. Successful exploitation results in complete takeover of the affected Oracle Coherence instance, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update. The vulnerability is classified under [CWE-284: Improper Access Control].

Critical Impact
Unauthenticated adjacent-network attackers can achieve full takeover of Oracle Coherence instances, compromising confidentiality, integrity, and availability of cluster data and services.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60211 published to the National Vulnerability Database (NVD)
2026-07-21 - Oracle addresses the vulnerability in the Oracle July 2026 Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60211

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used for distributed caching and application state management across clustered Java Virtual Machines (JVMs). The vulnerability resides in the Core component, which handles cluster membership, node discovery, and inter-node communication. An attacker positioned on the same physical network segment as a Coherence node can interact with cluster communication channels without authentication.

The flaw is categorized as improper access control [CWE-284]. Coherence trusts peers on the local communication segment for cluster protocol operations. An adjacent attacker can inject crafted cluster messages or join the cluster as a rogue member. Once accepted by the cluster, the attacker gains the ability to read cached data, modify entries, execute serialized payloads on cluster members, and disrupt service.

Root Cause

The root cause is insufficient authentication and access enforcement for cluster-membership and peer-communication traffic on the adjacent network segment. Coherence's default trust model assumes network segmentation provides a sufficient security boundary, allowing peers reachable on the cluster communication channel to participate without cryptographic authentication.

Attack Vector

The attack vector is Adjacent Network, requiring the attacker to reach the physical or logical broadcast domain where Coherence nodes communicate. No privileges or user interaction are required, and exploitation complexity is low. The attacker sends crafted cluster protocol messages to establish rogue membership or manipulate an existing node, leading to takeover of the Coherence instance and downstream applications that rely on it.

No public proof-of-concept code is available. Refer to the Oracle July 2026 Security Alert for vendor-supplied technical detail.

Detection Methods for CVE-2026-60211

Indicators of Compromise

Unexpected node join events in Coherence cluster logs, particularly from IP addresses not registered in the deployment inventory.
Anomalous cluster membership changes, split-brain events, or repeated MemberJoined and MemberLeft messages outside maintenance windows.
Unusual deserialization activity or ClassNotFoundException traces in Coherence JVM logs indicating attempts to load attacker-supplied classes.

Detection Strategies

Monitor Coherence cluster ports (default TCMP/TCP 7574 and UDP multicast) for traffic originating from unauthorized hosts.
Correlate JVM process telemetry with network flow data to identify unexpected peer connections on adjacent VLANs.
Baseline expected cluster member counts and alert on deviations, including transient joins from unknown MAC or IP addresses.

Monitoring Recommendations

Ingest Coherence logs and Fusion Middleware audit records into a centralized logging platform for correlation with network telemetry.
Enable ARP and DHCP monitoring on segments hosting Coherence nodes to identify rogue devices on the adjacent network.
Track outbound connections from Coherence JVMs; unexpected egress may indicate a compromised node executing attacker payloads.

How to Mitigate CVE-2026-60211

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle Coherence deployments running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Inventory all Coherence nodes, including embedded deployments in WebLogic and custom applications, and prioritize patching for internet-adjacent or shared-segment installations.
Restrict the physical and logical network segments where Coherence cluster traffic is permitted to trusted hosts only.

Patch Information

Oracle released fixes for CVE-2026-60211 in the July 2026 Critical Patch Update. Details for affected versions and patch download instructions are available in the Oracle July 2026 Security Alert. Apply the patches following Oracle's recommended maintenance procedures for Fusion Middleware components.

Workarounds

Isolate Coherence cluster communication onto a dedicated, access-controlled VLAN with strict Layer 2 filtering and no untrusted endpoints.
Enable Coherence Secure Sockets Layer (SSL) transport and cluster member authentication to require cryptographic identity for peer joins.
Enforce host-based firewall rules limiting inbound TCMP and cluster ports to known cluster member IP addresses.
Disable multicast discovery in favor of Well-Known-Addresses (WKA) configuration listing only authorized cluster members.

bash

# Example: restrict Coherence cluster traffic to known members via iptables
iptables -A INPUT -p tcp --dport 7574 -s 10.10.20.0/28 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
iptables -A INPUT -p udp --dport 7574 -s 10.10.20.0/28 -j ACCEPT
iptables -A INPUT -p udp --dport 7574 -j DROP