CVE-2026-60229: Oracle Coherence RCE Vulnerability

CVE-2026-60229 Overview

CVE-2026-60229 is a critical vulnerability in Oracle Coherence, a component of Oracle Fusion Middleware. The flaw resides in the Core component and allows an unauthenticated attacker with network access via TCP to fully compromise the target. Successful exploitation results in complete takeover of Oracle Coherence, impacting confidentiality, integrity, and availability. The vulnerability is classified under [CWE-306] Missing Authentication for Critical Function, indicating that a critical function is accessible without proper authentication controls. Oracle addressed this issue in the July 2026 Critical Patch Update.

Critical Impact
An unauthenticated remote attacker can take over Oracle Coherence instances over TCP, resulting in full loss of confidentiality, integrity, and availability.

Affected Products

Oracle Coherence version 12.2.1.4.0
Oracle Coherence versions 14.1.1.0.0 and 14.1.2.0.0
Oracle Coherence version 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60229 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60229

Vulnerability Analysis

CVE-2026-60229 affects the Core component of Oracle Coherence, an in-memory data grid used across Oracle Fusion Middleware deployments. The vulnerability is remotely exploitable over TCP without authentication or user interaction. An attacker with only network reachability to a Coherence cluster port can trigger the flaw and gain control of the process. Because Coherence typically runs with access to sensitive application state and clustered data, a successful takeover exposes cached objects, configuration, and downstream systems.

The impact profile shows high impact to confidentiality, integrity, and availability, consistent with product takeover rather than isolated data disclosure or denial of service. Exploitation complexity is low, and no privileges are required prior to the attack. This combination places the vulnerability in the same operational risk class as prior Coherence deserialization and cluster protocol issues.

Root Cause

The root cause maps to [CWE-306] Missing Authentication for Critical Function. A critical operation exposed by the Coherence Core component does not enforce authentication before acting on attacker-supplied network input. As a result, requests that should be restricted to trusted cluster members or authenticated administrators are processed from arbitrary TCP peers. Oracle has not published implementation-level details of the flaw in the public advisory.

Attack Vector

Attack traffic reaches Coherence over TCP on the cluster or extend proxy ports. An attacker on the same network segment, or on any network with routable access to those ports, sends crafted messages to the exposed service. The service processes the request without validating the caller, allowing the attacker to invoke privileged functionality and achieve takeover. No credentials, tokens, or user interaction are required. Public exploit code is not available at the time of publication, and the EPSS estimate for near-term exploitation remains low.

No verified public proof-of-concept code is available. Refer to the Oracle Security Alert July 2026 for vendor-provided technical context.

Detection Methods for CVE-2026-60229

Indicators of Compromise

Unexpected inbound TCP connections to Coherence cluster ports (default 7574) or Coherence*Extend proxy ports from hosts outside the cluster allowlist.
New or unexpected child processes spawned by the Coherence JVM, or outbound connections from Coherence hosts to attacker-controlled infrastructure.
Anomalous entries in Coherence and Fusion Middleware logs referencing failed class resolution, unusual serialization activity, or unauthenticated administrative calls.

Detection Strategies

Alert on TCP traffic to Coherence ports originating from sources that are not part of the documented cluster or client inventory.
Baseline the Coherence JVM's process tree and flag deviations, including shells, scripting interpreters, or network utilities launched by the JVM.
Correlate Coherence host telemetry with identity and network events to surface unauthenticated administrative activity before impact spreads.

Monitoring Recommendations

Enable verbose logging on Coherence cluster and extend listeners, and forward logs to a centralized analytics platform for retention and search.
Monitor egress from Fusion Middleware hosts for connections to unfamiliar destinations, cloud metadata endpoints, or known malicious infrastructure.
Track Oracle Critical Patch Update compliance across all Coherence instances and alert when versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 remain unpatched.

How to Mitigate CVE-2026-60229

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to every affected Coherence deployment as the primary remediation.
Restrict TCP access to Coherence cluster and extend proxy ports so only authorized cluster members and application servers can connect.
Inventory all Oracle Fusion Middleware environments and confirm which run Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Review recent network and host telemetry on Coherence servers for signs of pre-patch exploitation before returning them to production trust.

Patch Information

Oracle released fixes for CVE-2026-60229 as part of the Oracle Security Alert July 2026. Administrators should apply the Critical Patch Update bundle that corresponds to their Coherence and Fusion Middleware version. Oracle patches are cumulative, so applying the current CPU addresses this and prior issues in the same component.

Workarounds

Place Coherence cluster and extend ports behind firewalls or security groups that restrict access to a strict allowlist of known cluster and client hosts.
Segment Coherence infrastructure onto dedicated internal networks with no direct exposure to user, DMZ, or internet-facing zones.
Enable Coherence authentication and TLS features supported by your version, and disable any unused listeners and proxies until patching is complete.

bash

# Example: restrict Coherence cluster port 7574 to trusted subnet using iptables
iptables -A INPUT -p tcp --dport 7574 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP

# Example: restrict Coherence*Extend proxy port 9099 to application tier only
iptables -A INPUT -p tcp --dport 9099 -s 10.10.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP