CVE-2026-60226 Overview
CVE-2026-60226 is a critical vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, affecting the Core component. Supported versions impacted include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker with network access via TCP can exploit this flaw to fully compromise Oracle Coherence. The weakness maps to [CWE-284] Improper Access Control and results in complete takeover of affected deployments.
Critical Impact
Unauthenticated attackers can achieve full compromise of Oracle Coherence over the network, with high impact to confidentiality, integrity, and availability.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60226 published to NVD
- 2026-07-23 - Last updated in NVD database
- Vendor advisory published in the Oracle Critical Patch Update Advisory - July 2026
Technical Details for CVE-2026-60226
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used within Oracle Fusion Middleware for distributed caching and computation. The vulnerability resides in the Core component and allows remote, unauthenticated attackers to interact with Coherence services over TCP. Oracle classifies the flaw as easily exploitable, requiring no privileges, no user interaction, and no local access.
Successful exploitation leads to takeover of Oracle Coherence, giving attackers control over cluster nodes, cached data, and any workloads coordinated through the grid. Because Coherence often stores session state, financial records, and application caches, compromise cascades into hosted applications. The Core component processes cluster and client traffic, expanding the attack surface anywhere a Coherence port is reachable.
The EPSS probability for CVE-2026-60226 is 0.486%, placing it in the 39th percentile as of 2026-07-23.
Root Cause
The issue is categorized under [CWE-284] Improper Access Control. Coherence's Core component fails to properly restrict actions available to unauthenticated network callers, allowing attackers to invoke privileged operations reserved for trusted cluster members or authenticated clients.
Attack Vector
The attack vector is network-based over TCP. An attacker who can reach a Coherence cluster port sends crafted traffic to the exposed service and obtains control without credentials. Deployments where Coherence ports are reachable from untrusted networks, DMZs, or shared internal segments face immediate exposure. Oracle has not published exploitation code, and no public proof-of-concept is currently listed for this CVE.
Refer to the Oracle Critical Patch Update Advisory - July 2026 for authoritative technical details.
Detection Methods for CVE-2026-60226
Indicators of Compromise
- Unexpected TCP connections to Coherence cluster ports (default 7574 for cluster discovery, plus dynamically assigned Extend/TCMP ports) from unknown or external sources.
- New or modified cache entries, invocation service calls, or MBean operations originating from unauthenticated sessions.
- Coherence node logs showing cluster membership changes, deserialization events, or class-loading activity that does not correlate with planned deployments.
Detection Strategies
- Inventory all Oracle Coherence instances and confirm versions against the affected list published in Oracle's July 2026 CPU.
- Baseline expected client IPs for Coherence Extend and cluster traffic, then alert on deviations.
- Correlate WebLogic, Fusion Middleware, and Coherence logs to spot post-compromise lateral movement into hosted applications.
Monitoring Recommendations
- Enable audit logging on Coherence management operations and forward logs to a centralized analytics platform.
- Monitor JVM behavior on Coherence nodes for anomalous child processes, outbound connections, or reflective class loading.
- Track firewall and NetFlow data for Coherence ports and flag any exposure beyond the intended cluster boundary.
How to Mitigate CVE-2026-60226
Immediate Actions Required
- Apply the fixes from the Oracle Critical Patch Update Advisory - July 2026 to all affected Coherence versions.
- Restrict TCP access to Coherence cluster and Extend ports so only authorized application tiers can reach them.
- Audit exposed Coherence deployments for signs of prior unauthenticated access before and after patching.
Patch Information
Oracle addresses CVE-2026-60226 in the July 2026 Critical Patch Update. Administrators running Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 must apply the corresponding CPU patch. Consult the advisory for exact patch identifiers and prerequisites.
Workarounds
- Place Coherence clusters on isolated network segments with strict firewall rules blocking untrusted TCP traffic.
- Enable Coherence authentication and TLS for Extend clients and cluster members where supported, per Oracle documentation.
- Disable or gate any Coherence management endpoints (JMX, REST) that are not required for production operation.
# Example firewall restriction limiting Coherence cluster ports to trusted subnets
iptables -A INPUT -p tcp --dport 7574 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
iptables -A INPUT -p tcp --match multiport --dports 9000:9100 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --match multiport --dports 9000:9100 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
