CVE-2026-60213 Overview
CVE-2026-60213 is a network-exploitable vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. Affected releases include versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker with HTTP access can send crafted requests that trigger a complete denial of service and modify a subset of Coherence-accessible data. The flaw is categorized under [CWE-400: Uncontrolled Resource Consumption]. Oracle disclosed the issue in the July 2026 Critical Patch Update. While exploitation complexity is high, no authentication or user interaction is required, expanding exposure across internet-facing and internal Coherence clusters.
Critical Impact
Successful exploitation causes a hang or repeatable crash of Oracle Coherence and grants unauthenticated attackers unauthorized update, insert, or delete access to some Coherence data.
Affected Products
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - Oracle publishes CVE-2026-60213 in the July 2026 Critical Patch Update
- 2026-07-21 - CVE-2026-60213 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60213
Vulnerability Analysis
CVE-2026-60213 resides in the Core component of Oracle Coherence, Oracle's in-memory data grid used by distributed Java applications for caching and clustering. An unauthenticated attacker with network access over HTTP can compromise the service. Oracle classifies the flaw as difficult to exploit, indicating that specific conditions or timing must align for successful attack execution.
The vulnerability produces two outcomes when exploited. First, Coherence enters a hang state or crashes repeatedly, resulting in a complete denial of service against the cluster. Second, the attacker gains unauthorized write access to a portion of the data managed by Coherence, enabling INSERT, UPDATE, or DELETE operations against cached objects. Confidentiality of stored data is not directly affected.
EPSS data as of 2026-07-23 reports an exploitation probability of 0.306% at the 22.787 percentile, reflecting low observed exploitation activity at disclosure time.
Root Cause
The issue maps to [CWE-400: Uncontrolled Resource Consumption]. Coherence fails to properly bound resource usage when handling specific HTTP-borne inputs to the Core component. Repeatable triggering of this condition drives the cache service into an unrecoverable state and exposes data-modification paths that should be protected.
Attack Vector
The attack path is remote and network-based over HTTP. No credentials, tokens, or user interaction are required. An attacker who can reach the Coherence HTTP listener sends crafted requests that both destabilize the service and reach data-modification endpoints. Oracle notes the attack complexity is high, requiring conditions outside the attacker's direct control.
No verified public proof-of-concept code is available. Technical details are limited to the Oracle Critical Patch Update July 2026 advisory.
Detection Methods for CVE-2026-60213
Indicators of Compromise
- Unexpected HTTP 5xx responses or connection resets from Coherence management and REST endpoints preceding a service hang
- Sudden Coherence JVM crashes, cluster member evictions, or repeated node restarts in coherence.log
- Unexplained mutations, insertions, or deletions in cached data sets not traceable to legitimate application activity
- Inbound HTTP traffic to Coherence ports from unexpected source addresses or non-application clients
Detection Strategies
- Baseline Coherence request patterns and alert on anomalous HTTP payload sizes or request rates against Core endpoints
- Correlate JVM crash events with preceding HTTP request bursts using centralized log aggregation
- Compare cache change events against application audit logs to surface writes that lack a matching upstream transaction
Monitoring Recommendations
- Enable Coherence JMX metrics for cluster health, member status, and request latency, and forward them to your SIEM
- Ingest Coherence and fronting reverse-proxy access logs to enable retrospective hunting against the Coherence HTTP surface
- Monitor network flows to Coherence HTTP ports and alert on connections from outside authorized application tiers
How to Mitigate CVE-2026-60213
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Coherence deployments running 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0
- Inventory internal and external exposure of Coherence HTTP listeners and remove public reachability where not required
- Review recent cache mutations and cluster stability events for signs of pre-patch exploitation
Patch Information
Oracle addressed CVE-2026-60213 in the July 2026 Critical Patch Update. Consult the Oracle Critical Patch Update July 2026 advisory for patch identifiers, download locations, and product-specific installation instructions. Apply fixes during the next available maintenance window and validate cluster health after deployment.
Workarounds
- Restrict HTTP access to Coherence Core endpoints using network ACLs, firewalls, or service-mesh policies limiting traffic to trusted application tiers
- Terminate Coherence HTTP traffic behind an authenticated reverse proxy that enforces rate limiting and request validation
- Disable Coherence HTTP interfaces that are not required by production workloads until patches are applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
