CVE-2026-60224 Overview
CVE-2026-60224 is a critical vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, specifically within the Core component. The flaw allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence deployments. Successful exploitation results in complete takeover of the affected Coherence instance, impacting confidentiality, integrity, and availability.
The vulnerability is classified under CWE-284: Improper Access Control and was disclosed as part of the Oracle Security Alert July 2026.
Critical Impact
An unauthenticated remote attacker can take over Oracle Coherence over TCP without user interaction, leading to full system compromise.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0 and 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60224 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60224
Vulnerability Analysis
Oracle Coherence is a distributed in-memory data grid used across Oracle Fusion Middleware deployments for caching and stateful clustering. The vulnerability resides in the Core component, which handles cluster membership, messaging, and data replication over TCP. An improper access control weakness allows an unauthenticated network attacker to interact with Coherence services without traversing standard authentication or authorization checks.
The issue is described by Oracle as easily exploitable, meaning no specialized conditions or elevated privileges are required. Because Coherence Core services often run with the privileges of the hosting Fusion Middleware application, successful exploitation can lead to full takeover of the process and downstream access to cached data, cluster peers, and integrated Fusion Middleware components.
Root Cause
The root cause is improper access control [CWE-284] in the Core component of Oracle Coherence. Network-facing TCP endpoints do not adequately enforce authentication or authorization boundaries before executing privileged operations, enabling unauthenticated clients to invoke functionality reserved for trusted cluster members.
Attack Vector
Exploitation requires only TCP network reachability to a Coherence cluster port. No credentials, user interaction, or prior foothold are needed. Attackers who can route packets to a Coherence node—whether from an adjacent segment, an exposed management network, or through a compromised internal host—can execute the attack. Refer to the Oracle Security Alert July 2026 for technical remediation details. No verified public proof-of-concept code was available at the time of publication.
Detection Methods for CVE-2026-60224
Indicators of Compromise
- Unexpected TCP connections to Coherence cluster ports from hosts outside the defined cluster membership.
- New or unauthorized Coherence cluster join events in Fusion Middleware logs.
- Anomalous Java process behavior on Coherence nodes, including child process spawning or outbound network callbacks.
- Unexplained cache mutations, key evictions, or invocation service calls originating from unknown members.
Detection Strategies
- Baseline legitimate Coherence cluster membership and alert on join or handshake events from unapproved IP addresses.
- Inspect network telemetry for TCP sessions to Coherence ports (typically in the Coherence Extend and cluster port ranges) originating from non-cluster hosts.
- Correlate Fusion Middleware audit logs with process-level telemetry to identify unauthenticated invocations of Coherence services.
Monitoring Recommendations
- Enable verbose Coherence logging for cluster membership, authentication failures, and invocation service calls.
- Forward WebLogic and Coherence logs to a centralized SIEM for correlation with network flow data.
- Monitor the parent Java process on Coherence nodes for suspicious child processes, file writes, or reverse shell patterns.
How to Mitigate CVE-2026-60224
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 instances.
- Inventory all Oracle Fusion Middleware deployments and identify any embedded Coherence components requiring patching.
- Restrict Coherence cluster and Extend ports to trusted management networks using host and network firewalls.
- Review logs for signs of prior exploitation across the affected version range.
Patch Information
Oracle addressed CVE-2026-60224 in the July 2026 Critical Patch Update. Administrators must download and apply the appropriate patch bundle for their Coherence version as documented in the Oracle Security Alert July 2026. Fusion Middleware environments that embed Coherence should follow the corresponding WebLogic Server patch guidance.
Workarounds
- Isolate Coherence cluster traffic on a dedicated, non-routable VLAN accessible only to authorized cluster members.
- Enforce Coherence Security Framework access controls and enable Secure Sockets Layer (SSL) for cluster and Extend communication.
- Block external access to Coherence ports at perimeter and internal segmentation firewalls until patching is complete.
# Configuration example: restrict Coherence cluster ports with iptables
# Allow only trusted cluster members to reach Coherence cluster port (default 7574)
iptables -A INPUT -p tcp --dport 7574 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
# Enable SSL for cluster communication in tangosol-coherence-override.xml
# <cluster-config>
# <socket-providers>
# <socket-provider id="mySSLProvider">
# <ssl>
# <protocol>TLS</protocol>
# </ssl>
# </socket-provider>
# </socket-providers>
# </cluster-config>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
