CVE-2026-60232 Overview
CVE-2026-60232 is a missing authentication vulnerability [CWE-306] in Oracle Coherence, a component of Oracle Fusion Middleware. The flaw affects supported versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Coherence, resulting in full takeover of the product. The vulnerability impacts confidentiality, integrity, and availability. Oracle disclosed the issue as part of its July 2026 Critical Patch Update.
Critical Impact
Unauthenticated remote attackers can take over Oracle Coherence deployments over HTTP without any user interaction, exposing cached application data and enabling full service compromise.
Affected Products
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60232 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60232
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used to scale mission-critical applications across Oracle Fusion Middleware deployments. CVE-2026-60232 allows an unauthenticated remote attacker to reach a Coherence endpoint over HTTP and gain control of the service. The Oracle advisory categorizes the issue as easily exploitable, requiring no privileges or user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the affected Coherence instance.
Root Cause
The underlying weakness maps to [CWE-306], Missing Authentication for Critical Function. A network-accessible Coherence function does not require authentication before performing privileged operations. This allows any client that can reach the HTTP interface to invoke functionality that should be restricted to authenticated administrators or trusted cluster members.
Attack Vector
Exploitation occurs over the network via HTTP. The attacker sends crafted requests to an exposed Coherence endpoint with no credentials. Because the attack complexity is low and no user interaction is required, internet-exposed or improperly segmented Coherence deployments are at direct risk. Public technical exploitation details are not available at the time of publication. Refer to the Oracle Critical Patch Update advisory for vendor guidance.
Detection Methods for CVE-2026-60232
Indicators of Compromise
- Unauthenticated HTTP requests to Coherence management or extend endpoints from external or unexpected internal sources.
- New or unexpected Coherence cluster members joining the grid.
- Unusual deserialization activity, cache modifications, or invocation service calls without a corresponding authenticated session.
Detection Strategies
- Inspect Coherence and WebLogic access logs for anonymous HTTP requests to Coherence REST, management, or Extend-over-HTTP endpoints.
- Monitor for outbound connections initiated by Coherence JVM processes to unknown hosts, which may indicate post-exploitation activity.
- Correlate process creation events on Coherence hosts with parent Java processes running coherence.jar to catch child shell or scripting activity.
Monitoring Recommendations
- Enable verbose HTTP request logging on Coherence Extend and management proxies and forward to a centralized SIEM.
- Track version inventory of coherence.jar across Fusion Middleware hosts to identify unpatched instances.
- Alert on any Coherence host initiating LDAP, JNDI, or arbitrary outbound HTTP callbacks not part of documented application behavior.
How to Mitigate CVE-2026-60232
Immediate Actions Required
- Apply the Oracle July 2026 Critical Patch Update to all Oracle Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 deployments.
- Remove any direct internet exposure of Coherence cluster ports and HTTP endpoints and restrict access to trusted management networks.
- Inventory Fusion Middleware environments to identify every host running Coherence, including embedded instances inside WebLogic and Coherence*Web.
Patch Information
Oracle addressed CVE-2026-60232 in the July 2026 Critical Patch Update. Administrators should download and apply the fixes referenced in the Oracle Critical Patch Update Advisory for each affected version. EPSS data as of 2026-07-23 reports a probability of 0.358% at the 28th percentile, but the missing-authentication class of flaw historically sees rapid weaponization once details become public.
Workarounds
- Place Coherence endpoints behind an authenticated reverse proxy or API gateway that enforces mutual TLS and client authentication.
- Enforce network segmentation with firewall rules limiting Coherence ports to known cluster members and administrative jump hosts.
- Disable unused Coherence Extend-over-HTTP and REST management proxies until patches are applied.
# Example iptables restriction limiting Coherence HTTP access to a management subnet
iptables -A INPUT -p tcp --dport 9099 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
