CVE-2026-60235 Overview
CVE-2026-60235 is a high-severity vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw is classified under [CWE-306] Missing Authentication for Critical Function. An unauthenticated attacker with network access via TCP can compromise Oracle Coherence without user interaction. Successful exploitation can trigger a complete denial-of-service condition through hangs or repeatable crashes. Attackers can also gain unauthorized read access to a subset of Coherence data and perform unauthorized update, insert, or delete operations on some accessible data.
Critical Impact
Unauthenticated network attackers can crash Oracle Coherence 15.1.1.0.0 and tamper with cached data over TCP with low attack complexity.
Affected Products
- Oracle Coherence 15.1.1.0.0
- Oracle Fusion Middleware (Core component)
- Deployments exposing Coherence cluster ports over TCP
Discovery Timeline
- 2026-07-21 - CVE-2026-60235 published to NVD
- 2026-07-23 - Last updated in NVD database
- July 2026 - Addressed in Oracle Security Alert July 2026
Technical Details for CVE-2026-60235
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used to cache and distribute application state across clustered JVMs. The affected Core component handles cluster membership, service invocation, and cache operations over TCP. This vulnerability allows an unauthenticated remote attacker to interact with Coherence services that should require authentication. The result is a hang or repeatable crash of the Coherence process, combined with partial data tampering and limited data disclosure. Because Coherence often stores session state, configuration data, and derived business objects, integrity impact can cascade into dependent applications.
Root Cause
The underlying weakness is [CWE-306] Missing Authentication for Critical Function. A network-exposed function in the Coherence Core does not verify the identity of the caller before executing sensitive operations. Any client able to reach the listening TCP port can invoke these operations directly.
Attack Vector
Exploitation requires only TCP network reachability to the Coherence cluster port. The attacker sends crafted requests to the unauthenticated function, which processes them with the same privileges as legitimate cluster members. No credentials, prior compromise, or user interaction is needed. In typical deployments, Coherence ports are exposed to application tiers, so any workload sharing that network segment can reach the vulnerable endpoint. The EPSS score is 0.348%, but ease of exploitation and the absence of authentication make internal exposure the primary risk factor.
No public proof-of-concept code has been released. See the Oracle Security Alert July 2026 for vendor-supplied technical details.
Detection Methods for CVE-2026-60235
Indicators of Compromise
- Unexpected Coherence node crashes, restarts, or cluster membership churn without a corresponding operational trigger.
- Coherence log entries showing malformed protocol frames or unauthenticated connections from unknown source IPs.
- Cache entries with unexpected modifications, insertions, or deletions that do not correlate with application activity.
- Inbound TCP connections to Coherence cluster ports from hosts outside the documented application tier.
Detection Strategies
- Baseline normal Coherence cluster traffic and alert on connections from source IPs outside the approved application subnet.
- Monitor JVM process stability metrics for Coherence nodes, alerting on repeated crashes or hangs across cluster members.
- Correlate application-layer errors that reference Coherence timeouts with concurrent network anomalies to that host.
Monitoring Recommendations
- Forward Coherence and JVM logs to a centralized SIEM and retain them for post-incident forensics.
- Enable flow logging on network segments hosting Coherence and alert on new peers joining cluster ports.
- Track cache mutation rates and compare against application transaction volume to surface unauthorized writes.
How to Mitigate CVE-2026-60235
Immediate Actions Required
- Apply the fixes published in the Oracle Security Alert July 2026 to all Coherence 15.1.1.0.0 deployments.
- Restrict TCP access to Coherence cluster and proxy ports to authorized application hosts using firewall or security group rules.
- Enable Coherence identity and TLS features so that cluster and Extend client connections require authentication and transport encryption.
- Inventory all Coherence deployments and confirm patch status before returning them to production traffic.
Patch Information
Oracle addressed CVE-2026-60235 in the July 2026 Critical Patch Update. Administrators should follow the patch matrix in the Oracle Security Alert July 2026 and apply the fix to Oracle Coherence 15.1.1.0.0 and any Fusion Middleware products that embed the vulnerable Coherence version.
Workarounds
- Place Coherence clusters on isolated network segments unreachable from user or internet-facing zones until patching is complete.
- Configure Coherence Access Controllers and Identity Asserters to enforce authentication on cluster join and Extend proxy connections.
- Require TLS for cluster and client communication to prevent unauthenticated peers from participating in the grid.
# Example: restrict Coherence cluster port with iptables to approved app tier
iptables -A INPUT -p tcp --dport 7574 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
