CVE-2026-60217 Overview
CVE-2026-60217 is a missing authentication vulnerability [CWE-306] in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via TCP can compromise Oracle Coherence with low attack complexity. The vulnerability carries a CVSS 3.1 Base Score of 10.0 due to scope change, allowing impact to extend beyond Coherence itself. Successful exploitation results in full takeover of the Oracle Coherence instance and can significantly affect additional connected products. Affected supported versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Critical Impact
Unauthenticated network attackers can achieve complete takeover of Oracle Coherence with impact extending to additional products through scope change.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0 and 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE CVE-2026-60217 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60217
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used to cache and distribute data across clustered Java application servers. The Core component exposes cluster communication and management functionality over TCP. The flaw allows attackers to interact with these services without providing credentials. Because Coherence often mediates data between other Fusion Middleware products, a compromise propagates outward into connected systems, which is reflected in the scope change designation. The attacker gains the ability to execute privileged operations against the Coherence node, including manipulating cached objects and cluster state.
Root Cause
The root cause is a missing authentication check on network-accessible functionality in the Coherence Core component [CWE-306]. Requests reaching the affected TCP endpoints are processed without verifying the caller's identity, permitting anonymous invocation of operations that should require authenticated access.
Attack Vector
Exploitation requires only TCP network reachability to a vulnerable Oracle Coherence node. No user interaction, prior authentication, or elevated privileges are needed. Attackers targeting exposed Coherence ports can send crafted protocol messages to trigger the vulnerable operations. Refer to the Oracle Security Alert July 2026 for details on affected services and required patches.
Detection Methods for CVE-2026-60217
Indicators of Compromise
- Unexpected TCP connections to Oracle Coherence cluster ports from untrusted networks or hosts outside the application tier.
- Anomalous cluster join events, node registrations, or configuration changes in Coherence logs without corresponding operator activity.
- Unusual serialized object payloads or spikes in cache mutation operations against Coherence nodes.
- Child processes spawned by Coherence JVMs, particularly shells or scripting interpreters.
Detection Strategies
- Inspect Coherence and WebLogic audit logs for unauthenticated cluster communication and unexpected management operations.
- Deploy network signatures on perimeter and east-west sensors to identify Coherence protocol traffic reaching hosts outside the trusted application segment.
- Correlate JVM process behavior with expected baselines to identify post-exploitation activity such as command execution or lateral movement.
Monitoring Recommendations
- Enable verbose audit logging on all Coherence nodes and forward logs to a centralized analytics platform for correlation.
- Monitor listening ports and network exposure of Coherence services continuously to catch configuration drift.
- Alert on new outbound connections initiated by Coherence JVM processes, which often indicate post-exploitation staging.
How to Mitigate CVE-2026-60217
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update for all affected Coherence versions without delay.
- Restrict TCP access to Coherence cluster ports to trusted application-tier hosts using network segmentation and host firewalls.
- Inventory all Coherence deployments, including embedded instances shipped with other Fusion Middleware products, and confirm patch status.
- Review authentication and identity assertion configuration for Coherence extend and cluster services.
Patch Information
Oracle addressed CVE-2026-60217 in the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Security Alert July 2026 to identify the specific patch bundle for their Coherence version and apply it to every node in the cluster.
Workarounds
- Block external access to Coherence TCMP and Extend proxy ports at the firewall and load balancer layers.
- Isolate Coherence clusters onto a dedicated management network reachable only by authorized application servers.
- Disable unused Coherence proxy services and management endpoints to reduce the exposed attack surface until patches are deployed.
# Example iptables rule restricting Coherence Extend proxy port (default 9099)
# to a trusted application subnet
iptables -A INPUT -p tcp --dport 9099 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
