CVE-2026-60239 Overview
CVE-2026-60239 is an access control vulnerability [CWE-284] in the Oracle Coherence product of Oracle Fusion Middleware. The flaw resides in the Core component and allows a low-privileged attacker with network access via HTTP to compromise Oracle Coherence. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all Oracle Coherence accessible data. The vulnerability introduces a scope change, meaning exploitation can significantly impact additional products beyond Oracle Coherence itself. Oracle addressed the issue in the July 2026 Critical Patch Update.
Critical Impact
Authenticated network attackers can gain full read and write access to Oracle Coherence data, with impact extending to adjacent Oracle Fusion Middleware components through scope change.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0 and 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE CVE-2026-60239 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60239
Vulnerability Analysis
Oracle Coherence is a distributed in-memory data grid used to scale Java applications by caching data across clustered JVMs. The vulnerability is categorized under [CWE-284] Improper Access Control, indicating that the Core component fails to correctly enforce authorization boundaries on HTTP-exposed operations. An attacker holding low-privileged credentials can issue crafted HTTP requests that bypass expected access checks. The result is unauthorized read and write access across data managed by Coherence caches. Because the vulnerability produces a scope change, the compromise extends outside the security authority of Coherence itself and can affect other Fusion Middleware components sharing the deployment.
Root Cause
The root cause is improper access control enforcement in the Coherence Core component when handling HTTP-based requests. Authorization decisions do not adequately restrict low-privileged principals from performing sensitive data operations. Oracle has not published deeper technical details beyond the July 2026 Critical Patch Update advisory.
Attack Vector
Exploitation requires network access to the Coherence HTTP interface and valid low-privileged credentials. No user interaction is required, and attack complexity is low. An attacker sends crafted HTTP requests that invoke Coherence operations the authenticated principal should not be authorized to perform. Because scope changes, impact propagates to data and functionality belonging to adjacent products in the Fusion Middleware stack.
No verified public proof-of-concept code is currently associated with this CVE. Refer to the Oracle Critical Patch Update July 2026 advisory for authoritative technical guidance.
Detection Methods for CVE-2026-60239
Indicators of Compromise
- Unexpected HTTP requests to Oracle Coherence management or data endpoints originating from accounts with limited privileges.
- Unauthorized changes, deletions, or additions to cache entries and Coherence-managed data stores.
- Access log entries showing low-privileged sessions performing administrative or cross-tenant data operations.
Detection Strategies
- Monitor Coherence HTTP endpoints for anomalous request patterns, particularly write or administrative operations executed by non-administrative users.
- Correlate authentication events with Coherence data-modification events to identify privilege mismatches.
- Alert on Fusion Middleware activity that crosses component boundaries following a Coherence session, consistent with the CVSS scope change.
Monitoring Recommendations
- Enable verbose audit logging on Coherence Core HTTP interfaces and forward logs to a centralized analytics platform.
- Baseline normal request rates and payload types for each service account interacting with Coherence, and alert on deviations.
- Track the current patch level of all Fusion Middleware deployments and flag hosts running affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
How to Mitigate CVE-2026-60239
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle Coherence instances running affected versions.
- Inventory all Fusion Middleware deployments to confirm no unpatched Coherence installations remain reachable over the network.
- Rotate credentials for any low-privileged Coherence accounts that may have been exposed prior to patching.
Patch Information
Oracle released fixes for CVE-2026-60239 as part of the Oracle Critical Patch Update July 2026. Administrators should review the advisory for version-specific patch identifiers and apply the corresponding updates for 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Workarounds
- Restrict network access to Coherence HTTP endpoints using firewall rules or network segmentation so only trusted management hosts can connect.
- Enforce strict least-privilege on Coherence service accounts and remove HTTP access for any principal that does not require it.
- Place a reverse proxy or Web Application Firewall in front of Coherence HTTP interfaces to filter unexpected request methods and paths until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
