CVE-2026-60225: Oracle Coherence Auth Bypass Vulnerability

CVE-2026-60225 Overview

CVE-2026-60225 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker with network access via HTTP to fully compromise Oracle Coherence. Successful exploitation results in complete takeover of the affected Coherence instance, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update. The vulnerability is categorized under [CWE-284: Improper Access Control].

Critical Impact
Unauthenticated attackers can remotely compromise Oracle Coherence over HTTP and take full control of the affected instance without user interaction.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0, 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60225 published to NVD following Oracle's July 2026 Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60225

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used across Fusion Middleware deployments for distributed caching and application state management. The vulnerability resides in the Core component and is reachable over HTTP without authentication. An attacker sending crafted requests to an exposed Coherence endpoint can gain full control of the target, bypassing normal access checks. Because Coherence typically stores application session data, cached credentials, and business objects, a successful compromise exposes highly sensitive runtime state. Oracle rates the issue as easily exploitable, meaning no elevated conditions such as privileged access or user interaction are required to trigger the flaw.

Root Cause

The issue is classified as [CWE-284: Improper Access Control]. A code path in the Core component fails to enforce authentication or authorization before executing privileged operations exposed via HTTP. This allows unauthenticated requests to reach functionality that should be gated behind identity verification, resulting in a full takeover primitive.

Attack Vector

Exploitation occurs over the network via HTTP with low attack complexity. The attacker requires no credentials, no user interaction, and no prior access to the environment. Any Oracle Coherence deployment with its management or cluster HTTP interface reachable from an untrusted network is exposed. Internet-facing Coherence endpoints are the highest-risk configuration, but internal deployments accessible to compromised workstations or lateral-movement footholds are equally vulnerable. Verified public exploit code is not currently available. Refer to the Oracle Security Alert July 2026 for vendor technical details.

Detection Methods for CVE-2026-60225

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Coherence management or cluster endpoints from external or unexpected internal sources.
New or unexpected child processes spawned by the Coherence JVM, such as shells or scripting interpreters.
Outbound network connections from Coherence servers to unknown IP addresses following anomalous inbound HTTP traffic.
Modifications to Coherence configuration files, deployed artifacts, or scheduled tasks on affected hosts.

Detection Strategies

Inspect Coherence and reverse-proxy access logs for anomalous POST or PUT requests targeting Core component URIs without valid session context.
Correlate inbound HTTP traffic to Coherence ports with subsequent process creation events on the host to identify exploitation chains.
Monitor JVM behavior for unexpected class loading, reflection activity, or serialization operations coming from HTTP request threads.

Monitoring Recommendations

Enable verbose HTTP access logging on all Coherence nodes and forward logs to a centralized analytics platform.
Baseline normal administrative traffic to Coherence and alert on deviations in source IP, request volume, or endpoint access patterns.
Track outbound connections from Coherence hosts and alert on connections to non-approved destinations.

How to Mitigate CVE-2026-60225

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all affected Coherence versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Inventory all Coherence deployments, including embedded instances within Fusion Middleware products, and confirm patch status.
Restrict network exposure of Coherence HTTP endpoints to trusted management networks only.
Review authentication logs and host telemetry on Coherence servers for signs of prior exploitation.

Patch Information

Oracle addressed CVE-2026-60225 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 advisory for patch identifiers, download locations, and version-specific installation guidance. Apply patches during the next available maintenance window and validate cluster health afterward.

Workarounds

Block external access to Coherence HTTP ports at the perimeter firewall and internal segmentation controls until patching is complete.
Place Coherence management interfaces behind an authenticating reverse proxy or VPN.
Disable unused HTTP-exposed Coherence services and management extensions where operationally feasible.
Enforce network segmentation so only application tiers that require Coherence access can reach cluster nodes.

bash

# Example: restrict Coherence HTTP management port with iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP