CVE-2026-60227: Oracle Coherence Auth Bypass Vulnerability

CVE-2026-60227 Overview

CVE-2026-60227 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access over TCP can compromise Oracle Coherence and take over the product. The flaw requires no user interaction and low attack complexity, making it trivial to weaponize once a reachable Coherence instance is identified. Oracle disclosed the issue in the Oracle CPU July 2026 Alert. The vulnerability is classified under [CWE-284] Improper Access Control.

Critical Impact
Unauthenticated remote attackers can fully take over affected Oracle Coherence deployments, impacting confidentiality, integrity, and availability of clustered application data and services.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0, 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60227 published to NVD
2026-07-21 - Oracle Critical Patch Update July 2026 released addressing the vulnerability
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60227

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used to scale distributed applications across clustered Java Virtual Machines (JVMs). The Core component exposes cluster communication over TCP, and the vulnerability allows an unauthenticated attacker with network reachability to compromise the service.

Oracle categorizes the issue as easily exploitable with impacts across confidentiality, integrity, and availability. Successful exploitation results in takeover of Oracle Coherence, meaning an attacker gains control over the clustered service and the data it manages. The associated weakness [CWE-284] indicates improper access control in a network-exposed interface.

EPSS currently estimates exploitation probability at 0.486%, though this metric can shift rapidly once public technical details or proof-of-concept code emerge for high-value middleware targets.

Root Cause

The root cause is improper access control in the Core component of Oracle Coherence. The service accepts network requests over TCP without adequately enforcing authentication or authorization, permitting unauthenticated clients to invoke privileged functionality. Oracle Coherence historically ships with cluster protocols that trust peer members, and misconfigurations or protocol-level weaknesses in this trust boundary have led to prior deserialization and takeover issues in the same product family.

Attack Vector

Exploitation occurs remotely over the network. An attacker who can reach a Coherence cluster port on an affected version sends crafted TCP traffic to the Core component. No credentials, user interaction, or prior foothold are required. Because Coherence clusters are often deployed on internal networks behind Fusion Middleware application tiers, an attacker who has established initial access to a corporate network can pivot directly to Coherence nodes.

No public proof-of-concept code has been verified at the time of writing. Refer to the Oracle CPU July 2026 Alert for authoritative technical details.

Detection Methods for CVE-2026-60227

Indicators of Compromise

Unexpected TCP connections to Oracle Coherence cluster ports (commonly 7574 for Coherence Extend and cluster ports in the 8000–9000 range) originating from untrusted network segments.
New or unfamiliar Java child processes spawned by the Coherence JVM, or outbound network connections from the Coherence process to attacker-controlled hosts.
Unexplained writes to disk under the Coherence installation directory or WebLogic domain directories hosting Coherence.

Detection Strategies

Inventory all Oracle Coherence instances and confirm versions against 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Monitor Coherence and JVM logs for abnormal deserialization errors, unexpected class loading, or authentication failures on cluster ports.
Alert on Coherence JVMs initiating outbound connections or executing operating system commands, which deviate from normal cluster behavior.

Monitoring Recommendations

Capture NetFlow or firewall logs for all traffic to Coherence TCP ports and baseline expected peers.
Forward JVM, WebLogic, and host process telemetry to a centralized analytics platform for correlation.
Review privileged account activity on hosts running Coherence for signs of post-exploitation lateral movement.

How to Mitigate CVE-2026-60227

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all Oracle Coherence instances running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Restrict network access to Coherence cluster ports so that only authorized application servers can reach them, using firewalls or security groups.
Audit exposure by scanning perimeter and internal networks for reachable Coherence ports and remediate any unintended exposure.

Patch Information

Oracle addressed CVE-2026-60227 in the July 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the Oracle CPU July 2026 Alert for each affected Coherence version. Patching Oracle Fusion Middleware components typically requires coordinated downtime across WebLogic domains and Coherence clusters, so schedule maintenance windows accordingly.

Workarounds

Isolate Coherence clusters on dedicated network segments accessible only to trusted application tiers.
Enable Coherence Secured Production Mode and configure SSL/TLS with mutual authentication between cluster members and Extend clients.
Disable or restrict Coherence*Extend proxy services that are not required for the deployment.

bash

# Example: restrict Coherence cluster port access with iptables
# Allow only trusted application server subnet 10.10.20.0/24 to reach Coherence TCP ports
iptables -A INPUT -p tcp -s 10.10.20.0/24 --dport 7574 -j ACCEPT
iptables -A INPUT -p tcp -s 10.10.20.0/24 --dport 8000:9000 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
iptables -A INPUT -p tcp --dport 8000:9000 -j DROP