CVE-2026-60216: Oracle Coherence RCE Vulnerability

CVE-2026-60216 Overview

CVE-2026-60216 is a critical vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, specifically within the Core component. Oracle Coherence is an in-memory data grid solution used for distributed caching and scalable data access in enterprise Java applications. The flaw allows an unauthenticated attacker with network access via TCP to fully compromise Oracle Coherence. Successful exploitation results in complete takeover of the affected instance, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update. The vulnerability is mapped to CWE-306: Missing Authentication for Critical Function.

Critical Impact
Unauthenticated remote attackers can achieve full takeover of Oracle Coherence over TCP, leading to complete loss of confidentiality, integrity, and availability.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE CVE-2026-60216 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60216

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle Coherence and is classified under CWE-306: Missing Authentication for Critical Function. Oracle Coherence exposes cluster and management functionality over TCP for inter-node communication and client access. The affected code path performs a sensitive operation without validating the identity of the caller. An attacker who can reach the TCP listener can invoke this operation directly and gain control of the Coherence instance.

Because Coherence nodes typically run with privileged access to cached enterprise data and often within trusted middleware tiers, a takeover cascades into data theft, data tampering, and lateral movement into connected Fusion Middleware services. Oracle rates the issue as easily exploitable and requires no user interaction.

Root Cause

The root cause is the absence of authentication controls on a critical function exposed by the Coherence Core component. Rather than a memory safety or injection issue, the flaw is a design and configuration weakness where a network-reachable endpoint accepts and processes commands without verifying the requester. This pattern is common in clustered middleware protocols that assume the network layer is trusted.

Attack Vector

Exploitation requires only network reachability to the Coherence TCP port. An attacker sends crafted protocol messages to the exposed listener to trigger the unauthenticated critical function. No credentials, prior access, or user interaction are required. Environments that expose Coherence ports beyond the internal cluster boundary, including through misconfigured firewalls, cloud security groups, or Kubernetes services, face immediate risk.

No verified public proof-of-concept has been published at the time of writing. See the Oracle Security Alert July 2026 for vendor technical details.

// No verified proof-of-concept is publicly available.
// Refer to the Oracle Critical Patch Update advisory for details.

Detection Methods for CVE-2026-60216

Indicators of Compromise

Unexpected TCP connections to Oracle Coherence cluster ports from hosts outside the defined cluster membership.
New or unusual Coherence cluster join events, MBean invocations, or cache mutations that do not correlate with application activity.
Java process anomalies on Coherence nodes such as spawned shells, outbound connections to untrusted hosts, or unexpected classloading.

Detection Strategies

Baseline Coherence cluster membership and alert on nodes joining from unapproved IP ranges or subnets.
Inspect WebLogic and Coherence logs for authentication-less management operations and unexpected serialization payloads.
Correlate network flow data with process telemetry on Coherence hosts to identify remote-triggered execution paths.

Monitoring Recommendations

Monitor egress from Coherence hosts, since post-exploitation activity commonly includes callbacks and data exfiltration.
Enable and forward Coherence audit and JMX logs to a centralized SIEM for correlation with endpoint telemetry.
Track EPSS movement for CVE-2026-60216 (currently 0.486%, percentile 39.037 as of 2026-07-23) as an early indicator of active exploitation.

How to Mitigate CVE-2026-60216

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Coherence deployments running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Inventory all Coherence nodes and confirm no cluster or extend ports are exposed to untrusted networks.
Rotate credentials and secrets accessible to Coherence-hosted data if exposure is suspected.

Patch Information

Oracle addressed CVE-2026-60216 in the July 2026 Critical Patch Update. Administrators should follow the guidance published in the Oracle Security Alert July 2026 and apply the patch bundle appropriate for their Fusion Middleware version. Coherence is frequently embedded in WebLogic and other Fusion Middleware stacks, so verify patch coverage across all dependent products.

Workarounds

Restrict TCP access to Coherence cluster and Extend ports using host firewalls, network ACLs, and cloud security groups so only known cluster members and application tiers can connect.
Enable Coherence security features including SSL/TLS for cluster communication and identity assertion for Extend clients.
Segment Coherence tiers behind a bastion or service mesh to eliminate direct exposure from user-facing networks until patching is complete.

bash

# Example iptables restriction limiting Coherence cluster ports to trusted subnet
iptables -A INPUT -p tcp --dport 7574 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
iptables -A INPUT -p tcp --dport 9099 -j DROP