CVE-2026-60214: Oracle Coherence Privilege Escalation

CVE-2026-60214 Overview

CVE-2026-60214 is an access control vulnerability [CWE-284] in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low-privileged attacker with access to the adjacent physical communication segment can compromise the Coherence instance. Successful exploitation results in unauthorized read, create, delete, or modify access to all Coherence-accessible data. The vulnerability carries a scope change, meaning attacks may impact additional products beyond Coherence itself. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Adjacent-network attackers with low privileges can achieve full read and write access to Oracle Coherence data, with scope change extending impact to other products.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0, 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60214 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60214

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle Coherence, Oracle's in-memory data grid used for distributed caching and application state management. The flaw is classified as an improper access control weakness [CWE-284]. An attacker positioned on the same physical network segment as the Coherence node can interact with the cluster communication layer using only low-level privileges. Because Coherence nodes rely on cluster membership and peer authentication over the adjacent network, insufficient access control allows an unauthenticated or minimally authenticated peer to manipulate cached data.

The scope change indicator signals that a successful attack can affect resources beyond Coherence, including downstream applications that consume Coherence data. Confidentiality and integrity impacts are both high, while availability is not directly affected.

Root Cause

The root cause is improper enforcement of access control on the Coherence cluster communication channel. The Core component does not sufficiently restrict what an adjacent peer can request, permitting unauthorized data reads and modifications through the cluster protocol.

Attack Vector

Exploitation requires adjacent network access to the physical segment hosting the Coherence node. The attacker must hold low privileges but does not require user interaction. Attack complexity is low, which makes exploitation practical wherever Coherence cluster traffic traverses a broadcast or shared network. Refer to the Oracle Security Alert July 2026 for vendor technical details.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60214

Indicators of Compromise

Unexpected Coherence cluster join events from hosts not part of the approved cluster membership roster.
Anomalous read or write volume against Coherence caches, especially bursts targeting sensitive data regions.
Unauthorized modifications to cached entries that do not correlate with legitimate application transactions.

Detection Strategies

Monitor Coherence cluster logs for unauthorized member joins, authentication failures, and Extend proxy connection anomalies.
Baseline normal cluster peer IP addresses and alert on new peers on the Coherence cluster port range.
Correlate application-level audit logs with Coherence cache mutations to identify writes that lack an originating business transaction.

Monitoring Recommendations

Enable verbose Coherence logging for cluster membership, TCMP, and Extend proxy events and forward to a centralized SIEM.
Deploy network flow monitoring on segments carrying Coherence traffic to detect unauthorized hosts speaking the cluster protocol.
Track privileged account activity on hosts co-located with Coherence nodes to identify pivoting attempts.

How to Mitigate CVE-2026-60214

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all Coherence deployments running affected versions.
Inventory all Oracle Fusion Middleware installations to identify Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 instances.
Restrict layer 2 access to network segments carrying Coherence cluster traffic and remove untrusted hosts.

Patch Information

Oracle released fixes for CVE-2026-60214 in the July 2026 Critical Patch Update. Full patch details are documented in the Oracle Security Alert July 2026. Administrators should validate patch application against each affected Coherence version listed above.

Workarounds

Isolate Coherence cluster traffic on a dedicated VLAN or private subnet with strict access control lists.
Enable Coherence SSL/TLS for cluster communication and require mutual authentication between cluster members.
Enforce Coherence identity assertion and role-based access control on Extend proxies to limit low-privileged client capabilities.
Disable multicast cluster discovery where feasible and use a well-known-address list to constrain membership.

bash

# Example: restrict Coherence cluster membership to specific hosts using well-known addresses
-Dcoherence.wka=10.10.20.11,10.10.20.12,10.10.20.13
-Dcoherence.wka.port=8088
-Dcoherence.override=tangosol-coherence-override.xml
# In override file: enable SSL and authorized-hosts filter for cluster communication