CVE-2026-60215: Oracle Coherence RCE Vulnerability

CVE-2026-60215 Overview

CVE-2026-60215 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via TCP to fully compromise Oracle Coherence deployments. Successful exploitation results in complete takeover of the affected instance, impacting confidentiality, integrity, and availability.

Affected versions include Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The underlying weakness is classified as Missing Authentication for Critical Function [CWE-306]. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
An unauthenticated remote attacker can take over Oracle Coherence over TCP, gaining full control of confidentiality, integrity, and availability without user interaction.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - Oracle publishes advisory in the July 2026 Critical Patch Update
2026-07-21 - CVE-2026-60215 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60215

Vulnerability Analysis

Oracle Coherence is a distributed in-memory data grid used to scale stateful applications across Oracle Fusion Middleware deployments. Coherence cluster members communicate over TCP for cluster management, data replication, and service invocation. The vulnerability resides in the Core component, which handles these network-facing cluster and service operations.

Because the flaw is classified under [CWE-306] Missing Authentication for Critical Function, a critical operation exposed by Coherence can be reached without any credentials. An attacker with TCP reachability to a Coherence node can invoke that operation directly. Oracle characterizes the vulnerability as easily exploitable and reports that successful attacks result in takeover of Oracle Coherence.

Root Cause

The root cause is the absence of authentication checks on a network-exposed critical function within the Coherence Core component. Sensitive cluster or service operations accept requests from any TCP peer able to reach the listening port, without verifying identity or authorization.

Attack Vector

The attack vector is network-based over TCP. The attacker requires no privileges and no user interaction. Any host able to reach a Coherence cluster port, including internal cluster ports commonly bound to non-routable networks, can trigger the vulnerable code path. Coherence instances exposed to untrusted networks, or reachable via a compromised internal host, are directly at risk.

No public proof-of-concept has been observed at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.486%. Refer to the Oracle Security Alert July 2026 for vendor technical detail.

Detection Methods for CVE-2026-60215

Indicators of Compromise

Unexpected TCP connections to Coherence cluster ports (default 7574 for cluster discovery and dynamically allocated Coherence Extend or TCMP ports) originating from hosts outside the defined cluster membership.
Newly registered Coherence services, cache mappings, or invocation services that were not deployed by application teams.
Java process spawning unusual child processes such as shells, curl, or wget from Coherence or WebLogic managed server accounts.

Detection Strategies

Inspect Coherence and WebLogic logs for cluster join events, invocation service calls, or serialization errors originating from unknown IP addresses.
Correlate host telemetry with network flow data to identify TCP sessions to Coherence ports from outside the expected cluster subnet.
Alert on process lineage where java running Coherence spawns interactive shells, script interpreters, or reconnaissance utilities.

Monitoring Recommendations

Enable verbose Coherence audit logging on cluster join, service registration, and invocation service execution paths.
Forward middleware and host logs to a centralized analytics platform and retain them long enough to support post-patch retrospective hunting.
Baseline legitimate cluster members by hostname and IP, and alert on deviations.

How to Mitigate CVE-2026-60215

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Coherence installations running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Inventory all Coherence deployments, including those embedded in WebLogic Server and third-party applications, and confirm patch status.
Restrict TCP access to Coherence cluster ports to known cluster members using host and network firewalls.

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Security Alert July 2026 advisory to identify the correct patch for each supported version and apply it to all cluster members simultaneously to avoid version skew.

Workarounds

Place Coherence clusters on isolated, non-routable network segments accessible only to authorized application tiers.
Enforce network segmentation and deny-by-default firewall rules between application zones and the Coherence cluster.
Enable Coherence TLS/SSL for cluster and Extend traffic and require identity tokens on Extend proxy services where supported.
Disable or remove Extend proxy endpoints that are not required by production workloads.

bash

# Example: restrict Coherence cluster ports to trusted subnet using iptables
iptables -A INPUT -p tcp --dport 7574 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 7574 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
iptables -A INPUT -p udp --dport 7574 -j DROP