CVE-2026-60218 Overview
CVE-2026-60218 is a high-severity vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, specifically affecting the Core component. The flaw allows a low-privileged attacker with network access via TCP to compromise Oracle Coherence and take over the affected instance. The root cause maps to [CWE-306]: Missing Authentication for Critical Function. Successful exploitation impacts confidentiality, integrity, and availability. Oracle disclosed the issue in the Oracle Security Alert July 2026.
Critical Impact
An authenticated attacker with minimal privileges can achieve full takeover of Oracle Coherence over the network, exposing cached data, cluster state, and downstream Fusion Middleware services.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60218 published to NVD
- 2026-07-21 - Oracle publishes advisory in the Oracle Security Alert July 2026
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60218
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used across Oracle Fusion Middleware for distributed caching and cluster coordination. CVE-2026-60218 resides in the Core component and is classified under [CWE-306] (Missing Authentication for Critical Function). An attacker who already holds low-level privileges on the network can reach exposed Coherence TCP services and drive the product to a full takeover state.
Oracle's advisory rates the issue as easily exploitable. The attack requires no user interaction and does not cross a trust boundary within the same security scope. Impact spans confidentiality, integrity, and availability, meaning an attacker can read cached data, alter cluster state, and disrupt services relying on the grid.
EPSS currently reports a 0.328% probability of exploitation. No public proof-of-concept, ExploitDB entry, or CISA KEV listing exists at the time of publication.
Root Cause
The underlying weakness is missing authentication on a critical function reachable over TCP. Coherence cluster and management interfaces exposed by the Core component do not enforce sufficient identity verification before executing privileged operations, allowing a low-privileged network peer to escalate to full product control.
Attack Vector
The attack vector is network-based over TCP. An attacker sends crafted requests to a reachable Coherence endpoint from any host that can connect to the cluster ports. Because Coherence clusters commonly span data-center segments and container networks, exposure often extends beyond application tiers into lateral movement paths.
No verified exploit code is publicly available. Refer to the Oracle Security Alert July 2026 for technical detail released by the vendor.
Detection Methods for CVE-2026-60218
Indicators of Compromise
- Unexpected TCP connections to Coherence cluster ports (default 7574 for cluster discovery and dynamically allocated Extend/proxy ports) from hosts outside the application tier.
- New or unrecognized Coherence cluster members joining the grid without a corresponding deployment change.
- Sudden creation, modification, or eviction of cache entries in Coherence MBeans or logs without a triggering application event.
Detection Strategies
- Inspect Coherence server logs for unauthenticated invocation of management or Extend proxy operations, and correlate with source IP addresses outside approved subnets.
- Enable and review JMX audit logging on the Coherence MBean server for privileged operations such as cluster shutdown, service suspension, and cache clearing.
- Baseline normal cluster membership and alert on member joins that do not originate from managed WebLogic or Kubernetes deployments.
Monitoring Recommendations
- Forward Coherence, WebLogic, and host telemetry into a centralized analytics platform and alert on anomalous TCP flows to grid ports.
- Monitor Fusion Middleware hosts for post-exploitation behavior such as new child processes spawned by Coherence JVMs, outbound connections to unknown infrastructure, and modifications to configuration files.
- Track EPSS and Oracle advisory updates for CVE-2026-60218 to reprioritize monitoring as exploitation activity evolves.
How to Mitigate CVE-2026-60218
Immediate Actions Required
- Apply the fixes documented in the Oracle Security Alert July 2026 to all Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 deployments.
- Inventory every Coherence cluster, including embedded instances shipped inside Fusion Middleware products, and confirm patch status for each node.
- Restrict Coherence TCP ports to trusted application-tier subnets using host firewalls, security groups, or Kubernetes NetworkPolicies until patches are deployed.
Patch Information
Oracle addresses CVE-2026-60218 in the July 2026 Critical Patch Update. Administrators must download and apply the Coherence patches referenced in the Oracle Security Alert July 2026 for each affected version. Oracle does not support partial patching, so all cluster members should be updated together to prevent version-skew failures.
Workarounds
- Enforce Coherence Extend client authentication and TLS/SSL on all cluster and proxy communication channels as documented in Oracle Coherence security configuration.
- Isolate Coherence clusters on dedicated, non-routable network segments and block cluster ports at perimeter and east-west firewalls.
- Remove Coherence JMX and management endpoints from any interface reachable by general users or untrusted workloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
