CVE-2026-60231 Overview
CVE-2026-60231 affects Oracle Coherence, an in-memory data grid component of Oracle Fusion Middleware. The vulnerability resides in the Core component and allows a low-privileged attacker with network access via HTTP to compromise Oracle Coherence. Successful exploitation can lead to unauthorized modification of some accessible data and unauthorized read access to a subset of data. The flaw maps to improper access control [CWE-284] and requires authentication but no user interaction.
Critical Impact
Authenticated remote attackers can perform unauthorized insert, update, and delete operations on Oracle Coherence data, as well as read a subset of accessible data, over the network via HTTP.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0, 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60231 published to NVD
- 2026-07-23 - Last updated in NVD database
- July 2026 - Addressed in the Oracle Critical Patch Update Advisory - July 2026
Technical Details for CVE-2026-60231
Vulnerability Analysis
Oracle Coherence is a distributed, in-memory caching and data grid platform used in Oracle Fusion Middleware deployments to accelerate data access and coordinate state across clustered applications. The vulnerability exists in the Core component and stems from improper access control, permitting an authenticated attacker with low privileges to invoke functionality beyond their authorization boundary.
The issue is classified under [CWE-284] (Improper Access Control). An attacker leveraging HTTP-accessible interfaces of Coherence can bypass authorization checks to reach data-plane operations. This yields limited but tangible confidentiality and integrity impact on data stored within the grid. Availability is not impacted according to the CVSS vector.
The vulnerability is described by Oracle as easily exploitable, and does not require user interaction. Exploitation scope is unchanged, meaning the impact is confined to the vulnerable Coherence component.
Root Cause
The root cause is insufficient enforcement of access control on operations exposed through Coherence's HTTP-accessible surfaces. Requests originating from an authenticated but low-privileged principal are processed without adequate authorization validation, permitting data operations that should be restricted to higher-privileged roles.
Attack Vector
Exploitation requires network access via HTTP to the Coherence endpoint and a valid low-privilege account. An attacker submits crafted HTTP requests to trigger read, insert, update, or delete operations against a subset of Coherence-accessible data. No user interaction is required, and attack complexity is low. Detailed technical mechanics are not published; refer to the Oracle Security Alert July 2026 for vendor-provided details.
Detection Methods for CVE-2026-60231
Indicators of Compromise
- Unexpected HTTP requests to Oracle Coherence management or REST endpoints originating from low-privileged service accounts.
- Anomalous write, update, or delete operations on Coherence caches performed by principals that historically only issue reads.
- Authentication events for Coherence users followed by lateral requests to protected cache resources.
Detection Strategies
- Enable and centralize Coherence access logs and audit trails, correlating principal identity with cache operation types.
- Baseline normal cache access patterns per service account and alert on deviations in operation type, volume, or target cache.
- Monitor middleware logs for HTTP 2xx responses to endpoints that should return 403 for the invoking role.
Monitoring Recommendations
- Forward Coherence, WebLogic, and reverse-proxy logs to a centralized SIEM or data lake for retention and correlation.
- Instrument alerts for administrative or cluster-management operations invoked outside of change windows.
- Track authentication anomalies against Coherence, including brute-force attempts and credential reuse from unexpected source IPs.
How to Mitigate CVE-2026-60231
Immediate Actions Required
- Apply the fixes documented in the Oracle Critical Patch Update Advisory - July 2026 to all affected Coherence versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
- Inventory Coherence deployments and identify HTTP-accessible interfaces exposed to internal or external networks.
- Rotate credentials for any low-privileged Coherence accounts that may have been used by unauthorized parties.
Patch Information
Oracle addressed CVE-2026-60231 in the July 2026 Critical Patch Update. Administrators should download and apply the Coherence patch corresponding to their installed version. Details, patch numbers, and prerequisites are published in the Oracle Security Alert July 2026.
Workarounds
- Restrict network access to Coherence HTTP endpoints using firewall rules or network policies so only trusted management hosts can reach them.
- Enforce least-privilege role assignments for all Coherence users and remove unused low-privilege service accounts.
- Front Coherence HTTP interfaces with an authenticating reverse proxy that applies additional authorization checks until patches are deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
