CVE-2026-60236: Oracle Coherence RCE Vulnerability

CVE-2026-60236 Overview

CVE-2026-60236 is a critical vulnerability in Oracle Coherence, a component of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker with network access via TCP to fully compromise affected Coherence instances. The vulnerability is classified under CWE-306 (Missing Authentication for a Critical Function).

Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Successful exploitation results in complete takeover of Oracle Coherence, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in its July 2026 Critical Patch Update.

Critical Impact
An unauthenticated attacker reachable over TCP can take over Oracle Coherence without user interaction or privileges, leading to full system compromise.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - Oracle publishes the July 2026 Critical Patch Update advisory addressing CVE-2026-60236
2026-07-21 - CVE-2026-60236 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60236

Vulnerability Analysis

CVE-2026-60236 affects the Core component of Oracle Coherence, an in-memory data grid used for distributed caching and processing in Oracle Fusion Middleware deployments. Oracle classifies the flaw as easily exploitable by an unauthenticated attacker with TCP network access to the Coherence cluster port. No user interaction is required, and the scope remains unchanged, indicating the attacker fully compromises the vulnerable component itself.

Successful exploitation results in complete takeover of Oracle Coherence, granting an attacker control over cached data, cluster state, and any application logic executed within the grid. Because Coherence often stores session state and business objects for upstream Java applications, compromise can cascade into connected middleware and databases.

Root Cause

The CWE-306 classification indicates that a critical function in the Coherence Core component can be reached without authentication. Historically, Coherence cluster and management traffic has relied on network-layer trust, allowing remote invocation of privileged operations when exposed to untrusted networks. Oracle has not published deeper technical details beyond the July 2026 Critical Patch Update advisory.

Attack Vector

Exploitation requires only TCP reachability to a Coherence node. An attacker sends crafted traffic to the exposed Coherence service and abuses the unauthenticated critical function to execute privileged operations, culminating in full takeover. Refer to the Oracle Security Alert - July 2026 for vendor guidance. Public proof-of-concept code is not available at time of writing, and the EPSS probability stands at 0.486%.

Detection Methods for CVE-2026-60236

Indicators of Compromise

Unexpected inbound TCP connections to Coherence cluster ports (default 9000, 7574, or custom Well Known Address ports) from non-cluster hosts.
New or modified Coherence cache entries, invocation service calls, or MBean operations originating from unauthenticated sources.
Java processes hosting Coherence spawning unexpected child processes or writing to filesystem paths outside application directories.
Outbound connections from Coherence JVMs to attacker-controlled infrastructure following inbound cluster traffic.

Detection Strategies

Baseline the set of hosts permitted to join or communicate with the Coherence cluster and alert on any deviation.
Inspect Coherence and WebLogic logs for authentication failures, deserialization errors, or unexpected invocation service usage.
Correlate JVM process telemetry with network flow data to identify Coherence nodes making anomalous outbound calls.

Monitoring Recommendations

Continuously monitor Coherence TCMP and Extend proxy ports for connections from outside the trusted subnet.
Enable verbose auditing on Coherence management endpoints and forward logs to a centralized SIEM.
Track Fusion Middleware patch levels against the July 2026 CPU baseline to ensure remediation is applied.

How to Mitigate CVE-2026-60236

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Coherence installations running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Restrict TCP access to Coherence cluster and Extend proxy ports so only trusted application hosts can reach them.
Audit exposed Coherence deployments, especially any instance reachable from the internet or untrusted internal segments.
Rotate credentials, tokens, and sensitive cached data on any cluster that was network-exposed before patching.

Patch Information

Oracle addressed CVE-2026-60236 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert - July 2026 for patch identifiers and platform-specific installation guidance across affected Fusion Middleware versions.

Workarounds

Place Coherence clusters behind firewalls or private subnets that block all untrusted TCP ingress until patching is complete.
Enforce Coherence Well Known Address lists and TLS between cluster members to reduce the exposed attack surface.
Disable unused Extend proxy services and management endpoints on production Coherence nodes.
Isolate Coherence JVMs with host-based access controls limiting the users, processes, and network peers permitted to interact with the service.

bash

# Example iptables rules restricting Coherence cluster ports to trusted app hosts
iptables -A INPUT -p tcp --dport 9000 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP
iptables -A INPUT -p tcp --dport 7574 -j DROP