CVE-2026-60221: Oracle Coherence Auth Bypass Vulnerability

CVE-2026-60221 Overview

CVE-2026-60221 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via TCP can compromise Oracle Coherence and achieve full product takeover. The flaw is classified under [CWE-284] Improper Access Control and affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle addressed the issue in the July 2026 Critical Patch Update. The vulnerability is easily exploitable and impacts confidentiality, integrity, and availability.

Critical Impact
An unauthenticated remote attacker can take over Oracle Coherence deployments over TCP, gaining full control of the in-memory data grid and any application data it stores.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60221 published to NVD
2026-07-23 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-60221

Vulnerability Analysis

Oracle Coherence is a distributed, in-memory data grid used to scale stateful applications across Oracle Fusion Middleware. The Core component exposes TCP-based cluster and extend services to client and peer nodes. CVE-2026-60221 allows an attacker to interact with these services without authenticating and gain control of the Coherence process.

Because Coherence typically runs with privileges to read, mutate, and evict cached objects, successful exploitation impacts confidentiality, integrity, and availability. Attackers can exfiltrate cached data, tamper with session state, or disrupt clustered applications that rely on the grid. The Oracle advisory lists the flaw as easily exploitable with no user interaction required.

Root Cause

The issue is tracked as improper access control [CWE-284] in the Core component. Oracle's advisory confirms the vulnerable code paths are reachable by unauthenticated network callers, indicating that authorization checks are missing or insufficient on privileged Coherence operations exposed over TCP.

Attack Vector

Exploitation requires only TCP network reachability to a Coherence listener port. No credentials, tokens, or user interaction are required. The attack scope is unchanged, meaning the compromise remains within the vulnerable Coherence component, but that component often processes sensitive application state. See the Oracle Security Alert July 2026 for vendor-supplied technical context.

No public proof-of-concept exploit code has been verified at the time of writing. Refer to Oracle's advisory for authoritative details on the affected code paths.

Detection Methods for CVE-2026-60221

Indicators of Compromise

Unexpected inbound TCP connections to Coherence cluster or Extend proxy ports from hosts outside the trusted grid.
New or unknown Coherence cluster members joining the grid without change-control approval.
Anomalous cache invalidations, key deletions, or bulk reads from Coherence-backed applications.
Java process spawning unexpected child processes on hosts running Coherence.

Detection Strategies

Inventory all Oracle Coherence instances and confirm the running version against the affected list (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0).
Baseline legitimate Coherence peers and alert on TCP sessions to cluster ports from unauthorized sources.
Enable and forward Coherence audit and JVM logs to a centralized analytics platform for correlation against process and network telemetry.

Monitoring Recommendations

Monitor Coherence host processes for unexpected command execution, script interpreters, or outbound connections initiated by the JVM.
Track network flow data for scanning behavior against Coherence default ports across middleware subnets.
Alert on configuration changes to Coherence cluster membership, well-known addresses, or security overrides.

How to Mitigate CVE-2026-60221

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Coherence deployments as the primary remediation.
Restrict Coherence cluster and Extend proxy ports to trusted management networks using firewalls and security groups.
Audit Coherence hosts for signs of unauthorized cluster membership or process activity prior to patching.

Patch Information

Oracle released fixes for CVE-2026-60221 in the July 2026 Critical Patch Update. Administrators should follow the version-specific instructions in the Oracle Security Alert July 2026 and validate that all cluster members are patched consistently to avoid mixed-version issues.

Workarounds

Place Coherence clusters on isolated network segments and block TCP access from application, DMZ, and user networks.
Enforce mutual TLS and Coherence Security Framework identity assertion for Extend clients where supported.
Disable unused Coherence Extend proxies and management endpoints until patches are deployed.

bash

# Example: restrict Coherence cluster ports to trusted middleware subnet using iptables
iptables -A INPUT -p tcp --dport 7574 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
iptables -A INPUT -p tcp --dport 9099 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP