CVE-2026-60219 Overview
CVE-2026-60219 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access over TCP to fully compromise affected Oracle Coherence deployments. Successful exploitation results in complete takeover of the Coherence cluster, impacting confidentiality, integrity, and availability. The vulnerability is classified under [CWE-306]: Missing Authentication for Critical Function. Affected supported versions include Oracle Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle addressed the issue in the Oracle Security Alert July 2026.
Critical Impact
Unauthenticated network attackers can achieve full takeover of Oracle Coherence clusters, exposing cached application data and enabling downstream compromise of Fusion Middleware environments.
Affected Products
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE CVE-2026-60219 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60219
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used by enterprise Java applications for caching, session management, and distributed computation. Coherence cluster members communicate over TCP using proprietary protocols such as Coherence Extend and TCMP. The vulnerability resides in the Core component and is exposed through network-facing cluster interfaces.
An attacker who can reach the exposed Coherence TCP port does not require credentials, user interaction, or elevated privileges. Exploitation results in full compromise of the Coherence process, allowing arbitrary access to cached objects and cluster control operations. Because Coherence typically runs alongside business-critical Fusion Middleware workloads, takeover can be leveraged for lateral movement across WebLogic, Identity, and application-tier services.
Root Cause
The issue is a Missing Authentication for Critical Function weakness [CWE-306]. Core Coherence functionality is reachable over the network without enforcing authentication on the caller. An attacker can invoke privileged cluster operations directly, bypassing any application-layer access controls.
Attack Vector
Exploitation requires only TCP connectivity to an exposed Coherence listener. No credentials or user interaction are needed. The attacker sends crafted requests to the Coherence Core service, which processes them without verifying identity, leading to cluster takeover. Coherence ports reachable from untrusted networks — including misconfigured cloud environments and DMZ segments — are at highest risk. No public exploit code or CISA KEV listing has been recorded at time of writing. Refer to the Oracle Security Alert July 2026 for vendor technical detail.
Detection Methods for CVE-2026-60219
Indicators of Compromise
- Unexpected inbound TCP connections to Coherence cluster ports (default 9000, 7574, and Extend proxy ports) from external or non-application-tier hosts.
- New Coherence cluster members joining from unknown IP addresses or unusual MemberIdentity values in cluster logs.
- Unexplained cache mutations, invalidations, or entry processors executing outside normal application workflows.
- Java processes spawning shells or unusual child processes on Coherence hosts.
Detection Strategies
- Monitor Coherence and JVM logs for anomalous Member joined, Service started, or entry processor invocation events.
- Baseline expected client IP ranges for Extend proxies and alert on deviations.
- Enable JVM audit logging and correlate Coherence process activity with host-level telemetry for lateral movement indicators.
Monitoring Recommendations
- Ingest Coherence, WebLogic, and host telemetry into a centralized analytics platform to correlate cluster events with endpoint behavior.
- Continuously monitor for exposure of Coherence TCP ports to untrusted network segments using external attack surface tooling.
- Track outbound network activity from Coherence hosts to identify command-and-control or data-exfiltration behavior following exploitation.
How to Mitigate CVE-2026-60219
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 deployments without delay.
- Inventory all Coherence clusters and verify network exposure of cluster and Extend proxy ports.
- Restrict Coherence TCP ports to trusted application-tier subnets using firewall or security-group rules.
- Rotate credentials, tokens, and secrets stored in Coherence caches if exposure is suspected.
Patch Information
Oracle released fixes as part of the Oracle Security Alert July 2026. Administrators should apply the corresponding Coherence patches for versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 in accordance with Oracle's Critical Patch Update guidance.
Workarounds
- Isolate Coherence cluster traffic on dedicated network segments accessible only to authorized application servers.
- Enable Coherence Extend client authentication and TLS on all Extend proxies where the feature is available.
- Enforce strict egress controls on Coherence hosts to limit post-exploitation lateral movement.
- Disable or block unused Coherence services and management endpoints until patches are applied.
# Configuration example: restrict Coherence cluster ports to trusted subnet
iptables -A INPUT -p tcp --dport 9000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP
iptables -A INPUT -p tcp --dport 7574 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
