CVE-2026-60230: Oracle Coherence RCE Vulnerability

CVE-2026-60230 Overview

CVE-2026-60230 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via TCP to fully compromise affected Coherence instances. Successful exploitation results in complete takeover of the Oracle Coherence deployment, impacting confidentiality, integrity, and availability. The vulnerability is classified under CWE-306: Missing Authentication for Critical Function. Oracle addressed the issue in the Oracle Critical Patch Update July 2026.

Critical Impact
An unauthenticated remote attacker can take over Oracle Coherence clusters via TCP, leading to loss of confidentiality, integrity, and availability across cached data and distributed workloads.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60230 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60230

Vulnerability Analysis

Oracle Coherence is a distributed in-memory data grid used to scale stateful applications across Fusion Middleware deployments. This vulnerability sits in the Core component and enables unauthenticated attackers reaching a Coherence TCP listener to seize control of the target instance. Because Coherence cluster members typically run with broad privileges over cached objects and application state, takeover extends beyond a single node.

The attack requires no authentication, no user interaction, and low complexity. Any host able to open a TCP session to a Coherence port is a viable attack surface, including internal management networks that were historically considered trusted.

The EPSS probability is 0.486% as of 2026-07-23, but the ease of exploitation and history of similar Oracle Coherence deserialization flaws increase the likelihood of weaponization once technical details circulate.

Root Cause

The issue maps to CWE-306: Missing Authentication for Critical Function. Coherence's Core component exposes functionality reachable over TCP without enforcing an authentication check appropriate for the operations it performs. Oracle's advisory does not publicly detail the specific method, but the class of flaw allows adversaries to invoke privileged behavior in the Coherence process directly.

Attack Vector

Exploitation is remote and network-based. An attacker sends crafted TCP traffic to a Coherence listener reachable from their position, executes the unauthenticated code path, and pivots to full control of the Coherence node. From there, the attacker can manipulate cached objects, exfiltrate sensitive data, or use the compromised JVM to attack adjacent Fusion Middleware services. Refer to the Oracle Security Alert July 2026 for vendor guidance.

Detection Methods for CVE-2026-60230

Indicators of Compromise

Unexpected inbound TCP connections to Coherence cluster ports from hosts outside the cluster membership list.
New or modified Java processes spawned by the Coherence JVM, or child processes such as cmd.exe, powershell.exe, bash, or sh.
Outbound network connections from Coherence hosts to unfamiliar external IP addresses shortly after inbound TCP activity.
Anomalous serialized object traffic or oversized payloads directed at Coherence listener ports.

Detection Strategies

Baseline the expected cluster membership and alert when non-member IPs connect to Coherence TCP ports.
Monitor the Coherence JVM for process lineage anomalies, especially command interpreters or scripting hosts launched by the WebLogic or Coherence Java process.
Correlate WAF, firewall, and host telemetry to surface reconnaissance against Fusion Middleware ports followed by targeted TCP sessions.

Monitoring Recommendations

Ingest Coherence, WebLogic, and host process telemetry into a centralized analytics platform for cross-source correlation.
Track authentication and configuration events on adjacent Fusion Middleware components to detect lateral movement from a compromised Coherence node.
Enable file integrity monitoring on Coherence configuration files and cluster override descriptors such as tangosol-coherence-override.xml.

How to Mitigate CVE-2026-60230

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Coherence installations running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Restrict TCP access to Coherence cluster ports to known cluster members using firewall rules or security groups.
Inventory all Coherence deployments, including embedded instances inside WebLogic domains, to ensure no host is missed.
Review Coherence hosts for signs of prior exploitation before patching, and rotate credentials handled by the JVM.

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for the exact patch identifiers and installation procedures for each affected release.

Workarounds

Isolate Coherence clusters on dedicated network segments with strict allow-lists for cluster member IPs.
Enable Coherence Security Framework features such as identity assertion and cluster join authorization where supported by the deployed version.
Terminate Coherence traffic on TLS with mutual authentication between cluster members to prevent unauthenticated peers from joining or communicating.
Where patching is delayed, place Coherence listener ports behind host firewalls that drop traffic from any source outside the cluster.

bash

# Example iptables restriction limiting Coherence TCP ports to cluster peers
CLUSTER_PEERS="10.0.1.10 10.0.1.11 10.0.1.12"
COHERENCE_PORTS="7574 8088 9099"

for peer in $CLUSTER_PEERS; do
  for port in $COHERENCE_PORTS; do
    iptables -A INPUT -p tcp -s $peer --dport $port -j ACCEPT
  done
done

for port in $COHERENCE_PORTS; do
  iptables -A INPUT -p tcp --dport $port -j DROP
done