CVE-2026-60238 Overview
CVE-2026-60238 affects the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can compromise Oracle Coherence, though the vulnerability is difficult to exploit. The flaw carries a scope change, meaning successful attacks can impact products beyond Oracle Coherence itself. Exploitation can lead to unauthorized update, insert, or delete access to a subset of Coherence data, as well as unauthorized read access to some data. The vulnerability is categorized under [CWE-284] Improper Access Control.
Critical Impact
Unauthenticated network attackers can achieve limited read and write access to Oracle Coherence data with scope change to adjacent products.
Affected Products
- Oracle Coherence version 12.2.1.4.0
- Oracle Coherence version 14.1.1.0.0
- Oracle Coherence versions 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60238 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60238
Vulnerability Analysis
The vulnerability resides in the Core component of Oracle Coherence, an in-memory data grid used within Oracle Fusion Middleware deployments. An unauthenticated attacker can send crafted HTTP traffic to a Coherence endpoint to bypass access control restrictions. Successful exploitation results in partial confidentiality and integrity impact, allowing the attacker to read a subset of accessible data and to modify, insert, or delete another subset. The scope-change attribute indicates that impact can extend to components and products beyond Coherence, because the affected process can influence resources controlled by a different security authority. Availability is not directly impacted.
Root Cause
The root cause is improper access control [CWE-284] in the Coherence Core handling of network-facing HTTP requests. Authorization decisions are not consistently enforced before privileged data operations are performed. This deficiency allows an unauthenticated caller to reach code paths that should require authenticated context.
Attack Vector
The attack vector is remote over HTTP. The attacker requires no privileges and no user interaction. Attack complexity is high, meaning exploitation depends on specific conditions such as configuration, network reachability, or timing. Because the vulnerable service is typically deployed inside application server tiers, exposure is highest where Coherence management or cluster endpoints are reachable from untrusted networks.
No public proof-of-concept code has been published. See the Oracle Security Alert - July 2026 for vendor technical details.
Detection Methods for CVE-2026-60238
Indicators of Compromise
- Unauthenticated HTTP requests to Oracle Coherence cluster or management endpoints from external or unexpected internal sources.
- Unexpected modifications, inserts, or deletions in Coherence caches without an associated authenticated session.
- Anomalous cross-component activity in Fusion Middleware logs consistent with the scope-change nature of the flaw.
Detection Strategies
- Inspect Coherence and WebLogic access logs for HTTP requests that reach Coherence endpoints without a preceding authentication event.
- Compare cache write activity against application-level audit trails to identify writes not tied to legitimate application transactions.
- Correlate network flow data with Coherence port activity to surface external hosts contacting cluster ports.
Monitoring Recommendations
- Enable verbose audit logging on Coherence management and REST endpoints and forward events to a centralized SIEM.
- Alert on any HTTP PUT, POST, or DELETE traffic to Coherence ports originating from outside the application tier.
- Baseline normal cluster traffic patterns and alert on deviations in request volume or source diversity.
How to Mitigate CVE-2026-60238
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle Coherence installations running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
- Inventory Coherence deployments across Fusion Middleware environments and confirm patch status for each cluster node.
- Restrict network reachability to Coherence HTTP and cluster ports so that only trusted application tier hosts can connect.
Patch Information
Oracle addressed CVE-2026-60238 in the July 2026 Critical Patch Update. Refer to the Oracle Security Alert - July 2026 for patch identifiers and installation guidance for each affected version.
Workarounds
- Place Coherence endpoints behind an authenticating reverse proxy or web application firewall that rejects unauthenticated HTTP requests.
- Enforce network segmentation using host firewalls or security groups to limit Coherence port exposure to known application servers.
- Disable any unused Coherence REST or management HTTP interfaces until patches can be applied.
# Example: restrict Coherence HTTP port to trusted application tier only
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
