CVE-2026-60222: Oracle Coherence Privilege Escalation

CVE-2026-60222 Overview

CVE-2026-60222 is a vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via the T3 or Internet Inter-ORB Protocol (IIOP) can compromise the product. Successful exploitation results in full takeover of Oracle Coherence, impacting confidentiality, integrity, and availability. The weakness is classified under [CWE-284] Improper Access Control. Oracle addressed the flaw in the July 2026 Critical Patch Update. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Critical Impact
Unauthenticated remote attackers reaching T3 or IIOP ports can achieve complete takeover of Oracle Coherence clusters, exposing cached data and enabling arbitrary control of middleware services.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60222 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60222

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used across Fusion Middleware deployments for caching, session replication, and distributed computation. The vulnerability resides in the Core component and is reachable over the T3 and IIOP remoting protocols. These protocols carry serialized Java objects between clients and cluster members. An attacker who can send crafted requests to a listening Coherence port can bypass access control checks and drive the server into an attacker-controlled state. The result is full compromise of the Coherence process, including read and write access to cached data and control over cluster operations. The flaw does not require authentication or user interaction, though exploitation carries additional complexity that raises the bar for reliable weaponization.

Root Cause

The issue is categorized as [CWE-284] Improper Access Control. Coherence does not sufficiently validate the origin or content of inbound T3 and IIOP messages before acting on them. Trust boundaries around remote invocation are not enforced, so an unauthenticated peer can invoke functionality that should be restricted to trusted cluster members.

Attack Vector

Exploitation occurs over the network. An attacker sends malicious T3 or IIOP traffic to an exposed Coherence listener, typically the cluster port used for member communication or a proxy service port. Because Coherence historically deserializes objects supplied over these protocols, an attacker able to reach these ports can trigger the access control failure and pivot to takeover. Coherence instances exposed beyond internal management networks are at highest risk.

No public proof-of-concept code is available. Refer to the Oracle Critical Patch
Update advisory for authoritative technical details on the affected code paths.

Detection Methods for CVE-2026-60222

Indicators of Compromise

Unexpected inbound TCP connections to Coherence cluster ports or proxy service ports from addresses outside the trusted management network.
Anomalous Java deserialization activity or unexpected child processes spawned by the WebLogic or Coherence JVM.
New or modified cache entries, cluster members joining without authorization, or invocation service calls originating from unknown clients.

Detection Strategies

Inspect Coherence and WebLogic server logs for T3 and IIOP handshake errors, invocation failures, or serialization exceptions correlating with external source addresses.
Use network monitoring to identify T3 or IIOP traffic crossing segmentation boundaries where it should not exist.
Deploy endpoint behavioral detection on hosts running Coherence to flag JVM processes launching shells, downloading payloads, or writing to unusual paths.

Monitoring Recommendations

Alert on new listeners bound to Coherence-related ports and on configuration changes to tangosol-coherence-override.xml or cluster member lists.
Baseline legitimate Coherence client IPs and generate alerts on deviations, particularly authenticated invocation traffic from unexpected sources.
Forward middleware and host telemetry to a centralized analytics platform to correlate network access with process-level activity on Coherence servers.

How to Mitigate CVE-2026-60222

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Coherence versions without delay. See the Oracle Security Alert July 2026.
Inventory all Coherence deployments, including standalone grids and instances embedded within WebLogic Server, and confirm the running version.
Restrict network exposure of T3 and IIOP ports to trusted management subnets using firewalls and security groups.

Patch Information

Oracle released fixes for CVE-2026-60222 in the July 2026 Critical Patch Update covering Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Administrators should follow the official patch application procedures documented in the Oracle Security Alert July 2026 and validate cluster health after deployment.

Workarounds

Disable the T3 and IIOP protocols on WebLogic and Coherence listeners where they are not required, or filter them through a network connection filter that restricts source addresses.
Enforce TLS and mutual authentication on Coherence cluster and extend client communication to reduce the attack surface for unauthenticated peers.
Place Coherence servers behind a segmented management VLAN with no direct exposure to user or internet-facing networks until patches are applied.

bash

# Example WebLogic connection filter restricting T3/IIOP to trusted subnets
# Configure in the WebLogic Admin Console: Domain > Security > Filter
# Connection Filter: weblogic.security.net.ConnectionFilterImpl
# Rules (order matters):
10.0.0.0/8   * * allow t3 t3s iiop iiops
192.168.0.0/16 * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops