CVE-2026-60212: Oracle Coherence RCE Vulnerability

CVE-2026-60212 Overview

CVE-2026-60212 is a missing authentication vulnerability [CWE-306] in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated remote attacker with TCP network access can compromise the affected Coherence cluster and achieve full product takeover. Oracle disclosed the issue in the July 2026 Critical Patch Update. The flaw affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Exploitation requires no user interaction and low attack complexity, resulting in high impact to confidentiality, integrity, and availability.

Critical Impact
Unauthenticated network attackers can take over Oracle Coherence instances, gaining full control over cached data, cluster membership, and application state.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60212 published to NVD alongside the Oracle Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60212

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used to scale mission-critical applications by distributing data across a cluster. The Core component handles cluster membership, service invocation, and inter-node communication over TCP.

This vulnerability allows attackers to interact with Coherence over the network without presenting valid credentials. Because Coherence nodes execute serialized operations and can invoke server-side logic on cached objects, taking over the service typically yields code execution and full access to grid contents. The AV:N/AC:L/PR:N/UI:N conditions make weaponization straightforward once a Coherence TCP port is reachable.

Root Cause

The issue maps to [CWE-306] Missing Authentication for Critical Function. A privileged Coherence operation exposed over TCP does not enforce authentication, so any client that can reach the listener can invoke it. Oracle has not published implementation details beyond the July 2026 advisory.

Attack Vector

Exploitation requires only network reachability to a Coherence cluster port. Coherence deployments frequently expose TCMP or Coherence*Extend listeners inside application tiers, and misconfigured perimeters or lateral movement can expose these ports to attackers. A single crafted request is sufficient to compromise the service.

No public proof-of-concept has been observed. The current EPSS probability is 0.486%. Refer to the Oracle Security Alert July 2026 for the authoritative technical description.

Detection Methods for CVE-2026-60212

Indicators of Compromise

Unexpected inbound TCP connections to Coherence cluster ports (default 7574 for cluster discovery, and configured Coherence*Extend proxy ports) from hosts outside the application tier.
New or unrecognized cluster members joining a Coherence cluster, particularly from non-corporate IP ranges.
Coherence log entries showing anonymous invocations, unexpected InvocationService calls, or deserialization errors.
Spawned child processes from the JVM hosting Coherence, such as shells or scripting interpreters.

Detection Strategies

Inventory Oracle Coherence instances by version and validate against the affected list from Oracle's July 2026 advisory.
Monitor JVM processes hosting Coherence for anomalous child processes, outbound connections, or file writes to temp directories.
Alert on Coherence configuration changes and cluster join events that originate from unexpected subnets.

Monitoring Recommendations

Ingest Coherence and application server logs into a centralized analytics platform and retain them for forensic review.
Enable network flow logging for the application tier and baseline traffic to Coherence ports to identify deviations.
Track authentication and TLS handshake failures on Coherence*Extend proxies to identify probing activity.

How to Mitigate CVE-2026-60212

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all Coherence installations running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Restrict TCP access to Coherence cluster and proxy ports to known application servers only.
Audit exposed Coherence endpoints from untrusted networks and remove any unnecessary internet exposure.

Patch Information

Oracle addressed CVE-2026-60212 in the July 2026 Critical Patch Update. Patch availability and download details are published in the Oracle Security Alert July 2026. Administrators should follow Oracle's documented upgrade path for each affected Coherence version.

Workarounds

Enforce network segmentation so Coherence ports are unreachable from user, DMZ, or internet-facing zones.
Enable Coherence identity and TLS features, including client authentication on Coherence*Extend proxies, where the deployment supports it.
Place a host-based firewall on Coherence nodes to allow only cluster member IPs on the TCMP and proxy ports.
Increase logging verbosity on Coherence services until patching is complete to support post-incident investigation.

bash

# Example: restrict Coherence cluster port 7574 and proxy port 9099 to app tier subnet
iptables -A INPUT -p tcp --dport 7574 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
iptables -A INPUT -p tcp --dport 9099 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP