CVE-2026-60220 Overview
CVE-2026-60220 is a vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via TCP can compromise Oracle Coherence when a user other than the attacker performs a required interaction. The flaw is mapped to CWE-284: Improper Access Control and carries a scope change, meaning exploitation can affect components beyond Coherence itself. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, and complete read access to all Coherence-accessible data.
Critical Impact
Remote, unauthenticated attackers can achieve full read and write access to data managed by Oracle Coherence, with impact extending to adjacent Fusion Middleware components through scope change.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60220 published to NVD
- 2026-07-23 - Last updated in NVD database
- July 2026 - Addressed in the Oracle Critical Patch Update July 2026
Technical Details for CVE-2026-60220
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used to scale Java application state across distributed clusters. CVE-2026-60220 resides in the Core component and stems from improper access control on network-facing functionality. Attackers reach the exposed TCP interface without credentials and coerce a legitimate user into performing an interaction that completes the attack chain. The vulnerability produces a scope change, so exploitation can pivot from Coherence into other Fusion Middleware products sharing the runtime or trust boundary. Impact is concentrated on confidentiality and integrity, with attackers gaining full read access to grid-stored data and the ability to create, alter, or delete records. Availability is not directly impacted, but data tampering in a distributed cache can cascade into application-level failures. Oracle addressed the flaw in its July 2026 Critical Patch Update across all supported branches.
Root Cause
The underlying weakness is improper access control [CWE-284] on Coherence's network-exposed Core functionality. Requests reaching the TCP listener are processed without sufficient authorization checks, permitting unauthenticated operations against grid data when combined with a victim-side interaction.
Attack Vector
Exploitation requires network reachability to a Coherence node over TCP and a human interaction from a user other than the attacker. No prior authentication or elevated privileges are needed. Because the vulnerability crosses a security scope, attacks succeeding against Coherence can affect additional Oracle products that trust its data or execution context. Oracle has not published exploitation details, and no public proof-of-concept is available at this time.
No verified public exploit code is available. See the Oracle Critical Patch Update July 2026 for vendor technical details.
Detection Methods for CVE-2026-60220
Indicators of Compromise
- Unexpected TCP connections to Coherence cluster ports from hosts outside the defined cluster membership.
- Unauthorized cache mutation events, including creation or deletion of entries by unauthenticated or anomalous principals.
- Coherence log entries showing failed authorization checks followed by successful data operations.
Detection Strategies
- Correlate Coherence access logs with authentication events to surface data operations lacking a valid authenticated session.
- Baseline normal cluster join and cache mutation patterns, then alert on deviations such as new client identities or bursts of write operations.
- Inspect middleware audit trails for cross-component activity originating from Coherence, which may signal scope-change exploitation.
Monitoring Recommendations
- Enable and forward Coherence audit and access logs to a centralized analytics platform for retention and correlation.
- Monitor network flows to Coherence Extend and cluster ports, restricting them to known application tiers.
- Track patch and version state for all Fusion Middleware hosts running Coherence to identify unpatched instances.
How to Mitigate CVE-2026-60220
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Coherence deployments running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
- Inventory Fusion Middleware components that share trust with Coherence and confirm they are patched to the same CPU level.
- Restrict Coherence TCP ports to allow-listed application servers using network segmentation and host firewalls.
Patch Information
Oracle released fixes as part of the July 2026 Critical Patch Update. Refer to the Oracle Critical Patch Update July 2026 advisory for the specific patch identifiers and installation procedures for each affected Coherence version.
Workarounds
- Place Coherence clusters behind internal network boundaries so untrusted networks cannot reach the TCP listener.
- Enforce Coherence authentication and TLS on cluster and Extend communications where configuration options permit.
- Educate application operators to avoid interacting with untrusted content or links that could serve as the required user interaction step.
# Example: restrict Coherence Extend/cluster ports to trusted application tier
# Replace 10.0.10.0/24 with your application subnet and 7574 with your configured port
iptables -A INPUT -p tcp --dport 7574 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
