CVE-2026-60234: Oracle Coherence RCE Vulnerability

CVE-2026-60234 Overview

CVE-2026-60234 is a critical missing authentication vulnerability [CWE-306] in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via TCP can compromise Oracle Coherence and achieve full product takeover. The flaw affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can take over Oracle Coherence deployments, resulting in complete loss of confidentiality, integrity, and availability of the affected data grid infrastructure.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60234 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60234

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used to scale mission-critical Java applications. The Core component exposes cluster services over TCP for member communication, extend clients, and management functions. CVE-2026-60234 stems from missing authentication on this network-exposed attack surface.

An attacker who can reach a Coherence listener port over the network can interact with cluster services without presenting credentials. Because the vulnerability requires no privileges, no user interaction, and low attack complexity, exploitation is straightforward once the port is reachable. Successful exploitation results in complete takeover of the Coherence instance, allowing manipulation of cached data, execution of grid operations, and pivoting into applications that trust the data grid.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. The Core component accepts requests on TCP endpoints without enforcing an authentication check, allowing any peer with network reachability to invoke privileged cluster operations reserved for trusted members or administrators.

Attack Vector

The attack vector is remote and network-based. An attacker sends crafted TCP traffic to an exposed Coherence cluster port, joins or interacts with the grid as if authenticated, and issues operations that lead to full compromise. No credentials, phishing, or victim interaction is required. Systems that expose Coherence ports to untrusted networks — including flat internal networks, misconfigured firewalls, or cloud security groups — are at the highest risk. No public proof-of-concept exploit is currently listed for this CVE, and the EPSS probability is 0.486%.

No verified public exploit code is available. Refer to the Oracle Critical Patch Update July 2026 advisory for vendor technical details.

Detection Methods for CVE-2026-60234

Indicators of Compromise

Unexpected cluster member join events in Coherence logs originating from IP addresses outside the approved cluster range.
New or unknown Coherence extend client connections to TCMP or extend proxy ports.
Anomalous cache mutations, invocation service calls, or Portable Object Format (POF) deserialization events without a corresponding application workflow.
Outbound network connections initiated from Coherence JVM processes to unfamiliar hosts.

Detection Strategies

Monitor Coherence audit and JVM logs for cluster membership changes, authentication failures, and management operations invoked outside normal maintenance windows.
Deploy network detection rules that alert on external sources connecting to Coherence cluster ports (default TCMP and extend listener ranges).
Correlate process telemetry from Coherence JVMs against baseline behavior to identify unexpected child processes, shell execution, or class-loading activity.

Monitoring Recommendations

Enable verbose Coherence logging for cluster join, service registration, and invocation service events, and forward logs to a centralized SIEM.
Baseline the expected set of cluster member IPs and alert on deviations in real time.
Watch for spikes in serialization or deserialization activity within Coherence, which can indicate exploitation attempts against the Core component.

How to Mitigate CVE-2026-60234

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all Oracle Coherence deployments running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Inventory all Coherence instances, including embedded deployments inside WebLogic or custom Java applications, and confirm patch coverage.
Restrict TCP access to Coherence cluster and extend proxy ports to trusted cluster members only using host firewalls and network ACLs.
Review recent logs for signs of unauthorized cluster joins or unexpected invocation service calls.

Patch Information

Oracle released fixes for CVE-2026-60234 as part of the Oracle Critical Patch Update July 2026. Administrators should follow Oracle's documented patch procedure for each affected Coherence version and validate cluster health after upgrade.

Workarounds

Isolate Coherence clusters on dedicated management networks and block cluster ports at the perimeter and between security zones.
Enforce mutual TLS and identity-asserter configurations for Coherence Extend and cluster communication where supported by the deployed version.
Disable unused Coherence services and management endpoints to reduce the exposed attack surface until patching completes.

bash

# Example: restrict Coherence cluster ports to trusted subnet only
iptables -A INPUT -p tcp --dport 7574 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
iptables -A INPUT -p tcp --dport 9099 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP