CVE-2026-60228 Overview
CVE-2026-60228 is a critical vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, specifically within the Core component. The flaw allows an unauthenticated attacker with network access via TCP to fully compromise Oracle Coherence instances. Successful exploitation results in complete takeover of the affected server, including its confidentiality, integrity, and availability. The vulnerability is rooted in missing authentication for a critical function [CWE-306]. Affected releases include Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle addressed the issue in the July 2026 Critical Patch Update.
Critical Impact
Unauthenticated attackers can achieve full takeover of Oracle Coherence over the network without user interaction.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0 and 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60228 published to NVD alongside Oracle's July 2026 Critical Patch Update
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60228
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used to scale mission-critical Java applications across clusters. The Core component handles cluster membership, cache management, and inter-node communication over TCP. This vulnerability allows a remote attacker to interact with an exposed Coherence service without providing credentials. Once contacted, the service processes attacker-supplied input in a way that leads to full compromise of the Coherence node. Oracle classifies the vulnerability as easily exploitable and rates all three impact dimensions as high.
The underlying weakness is categorized as Missing Authentication for a Critical Function [CWE-306]. Coherence exposes cluster and management functionality on TCP listeners that, in affected releases, do not enforce authentication for privileged operations. An attacker who can reach a Coherence port can therefore drive server-side logic directly.
Root Cause
The Core component does not require authentication before executing sensitive operations reachable over TCP. Any client able to negotiate the Coherence wire protocol is treated as trusted, effectively granting cluster-level privileges to network peers.
Attack Vector
Exploitation requires only network reachability to a Coherence TCP listener. No credentials, user interaction, or prior foothold is required. Because Coherence typically runs inside application middleware tiers, exposure through misconfigured network segmentation, cloud security groups, or shared internal networks materially increases the risk of exploitation. The EPSS score is 0.486% at the 39th percentile as of 2026-07-23, and no public proof-of-concept has been observed at the time of publication.
See the Oracle Critical Patch Update July 2026 advisory for technical details.
Detection Methods for CVE-2026-60228
Indicators of Compromise
- Unexpected TCP connections to Coherence cluster ports (commonly 9099, 7574, and Coherence Extend listener ports) from unrecognized internal or external hosts.
- New Java processes, shell processes, or outbound network callbacks spawned by the Coherence JVM.
- Unusual cache manipulations, cluster join events, or MBean operations recorded in Coherence logs without corresponding operator activity.
Detection Strategies
- Alert on anonymous or unauthenticated cluster join events and management operations in Coherence audit logs.
- Monitor process trees for child processes of the Coherence JVM, which typically should not spawn interactive shells or scripting interpreters.
- Correlate WebLogic and Fusion Middleware logs with network flow data to identify Coherence ports reachable from unexpected network zones.
Monitoring Recommendations
- Inventory every Coherence deployment and confirm the running version against the fixed releases listed in the July 2026 CPU.
- Baseline legitimate Coherence peers and alert on new sources initiating cluster or Extend protocol connections.
- Forward JVM, garbage collector, and Coherence logs to a centralized analytics platform to enable retrospective hunting once exploitation patterns are published.
How to Mitigate CVE-2026-60228
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Coherence installations running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
- Restrict TCP access to Coherence cluster and Extend ports to known application hosts using host-based firewalls and network ACLs.
- Audit perimeter and cloud firewall rules to confirm no Coherence port is reachable from the internet or untrusted network segments.
Patch Information
Oracle released fixes for CVE-2026-60228 as part of the Oracle Critical Patch Update July 2026. Administrators should follow the Fusion Middleware patch matrix to identify the correct bundle for each supported version and validate the patch in non-production environments before rolling out to production clusters.
Workarounds
- Place Coherence clusters on isolated, encrypted network segments accessible only to authorized application tiers.
- Enable Coherence Secure Socket Layer (SSL) and identity token features so cluster peers must present valid credentials before joining.
- Disable or firewall unused Coherence Extend proxies and management endpoints until patching is complete.
# Example iptables restriction limiting Coherence cluster port to trusted subnet
iptables -A INPUT -p tcp --dport 9099 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
