CVE-2026-60240 Overview
CVE-2026-60240 is a missing authentication vulnerability [CWE-306] in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access over TCP can compromise Oracle Coherence and achieve full product takeover. The flaw affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle disclosed the issue in the Oracle Security Alert July 2026. The EPSS score is 0.486% at the 39.031 percentile as of 2026-07-23.
Critical Impact
Unauthenticated network attackers can take over Oracle Coherence deployments, resulting in high impact to confidentiality, integrity, and availability.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE CVE-2026-60240 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60240
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used for distributed caching, session management, and low-latency data access across clustered Java applications. The vulnerability resides in the Core component and is classified under [CWE-306] Missing Authentication for a Critical Function. An attacker reaching the Coherence cluster over TCP can invoke privileged functionality without presenting credentials. Successful exploitation yields full takeover of the Coherence instance, according to Oracle's advisory.
Because Coherence nodes commonly hold cached data from downstream databases and application state, a compromised node exposes sensitive data and can be pivoted to attack backend systems. The vulnerability requires no user interaction and no prior privileges.
Root Cause
The root cause is the absence of authentication enforcement on a network-reachable Coherence function. When authentication checks are missing on critical operations, remote clients can invoke functionality intended only for trusted cluster members or administrators. Oracle has not published implementation-level details beyond the advisory.
Attack Vector
Exploitation occurs over the network via TCP against exposed Coherence cluster ports. The attacker sends crafted traffic to a listening Coherence endpoint and interacts with the unauthenticated function to achieve code execution or administrative control. No exploit code or public proof-of-concept is currently listed for this CVE, and it is not in the CISA Known Exploited Vulnerabilities catalog.
See the Oracle Security Alert July 2026 for vendor technical details.
Detection Methods for CVE-2026-60240
Indicators of Compromise
- Unexpected inbound TCP connections to Coherence cluster ports (default 9000, 7574, and Extend proxy ports) from non-cluster hosts.
- New or anonymous cluster member joins that do not correlate with authorized deployments.
- Java process spawning shells, curl, wget, or writing to disk from the Coherence JVM.
- Outbound connections from Coherence hosts to unfamiliar IP addresses following suspicious inbound traffic.
Detection Strategies
- Inspect network flow logs for external clients reaching Coherence Extend proxy or cluster ports and alert on non-allowlisted sources.
- Correlate JVM child-process creation on Coherence servers with preceding network events on cluster listener ports.
- Baseline Coherence cluster membership and alert when new members join outside change windows.
Monitoring Recommendations
- Forward Coherence logs, host process telemetry, and network flow data to a centralized analytics platform for correlation.
- Enable audit logging on the Fusion Middleware tier and monitor for administrative operations lacking an authenticated principal.
- Track file system changes under Coherence and WebLogic domain directories for unauthorized modifications.
How to Mitigate CVE-2026-60240
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update fixes for Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
- Restrict TCP access to Coherence cluster and Extend proxy ports to trusted management networks only.
- Inventory all Oracle Fusion Middleware deployments to identify Coherence components exposed to untrusted networks.
- Rotate credentials and secrets stored in or accessible from Coherence caches after patching.
Patch Information
Oracle addressed CVE-2026-60240 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for the exact patch bundles corresponding to each affected version and apply them following Oracle's standard Fusion Middleware patching procedure.
Workarounds
- Place Coherence clusters behind a firewall or private VLAN that blocks all untrusted inbound TCP traffic.
- Enable Coherence Security Framework and TLS for cluster and Extend communication where supported by the deployed version.
- Disable or remove any Coherence Extend proxy endpoints that are not required for application operation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
