CVE-2026-60241: Oracle Coherence RCE Vulnerability

CVE-2026-60241 Overview

CVE-2026-60241 is a critical vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, affecting the Core component. The flaw allows an unauthenticated attacker with network access via HTTP to fully compromise Oracle Coherence. Successful exploitation results in complete takeover of the affected instance, with impacts to confidentiality, integrity, and availability. The vulnerability maps to [CWE-306: Missing Authentication for Critical Function], indicating that a critical operation is exposed without requiring credentials. Oracle addressed the issue in its July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can take over Oracle Coherence servers over HTTP, resulting in full loss of confidentiality, integrity, and availability across affected Fusion Middleware deployments.

Affected Products

Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60241 published to NVD
2026-07-23 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60241

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used within Oracle Fusion Middleware for distributed caching and stateful data services. The vulnerability resides in the Core component and is reachable over HTTP without authentication. An attacker who can reach an exposed Coherence endpoint on the network can trigger the flaw with a single crafted request. The Easily exploitable classification in Oracle's advisory indicates no special conditions, tooling, or user interaction are required. Successful exploitation grants the attacker takeover of the Coherence service, meaning they gain control equivalent to the process running Coherence.

Because Coherence typically stores session data, cached business objects, and cluster state, a takeover exposes application data and can be pivoted into broader Fusion Middleware compromise. The unauthenticated network attack surface makes this vulnerability suitable for opportunistic mass scanning once exploit code becomes public.

Root Cause

The [CWE-306] classification indicates missing authentication for a critical function exposed by Coherence over HTTP. A privileged operation reachable through the Core component does not verify the identity of the requester before execution. Oracle has not published detailed root-cause internals; refer to the Oracle Security Alert July 2026 for vendor-provided context.

Attack Vector

The attack originates over the network via HTTP against a listening Coherence endpoint. No credentials, prior access, or user interaction are required. An attacker sends a crafted HTTP request to the vulnerable Core interface and obtains control over the Coherence instance. Environments that expose Coherence management or cluster ports beyond trusted network segments are at highest risk.

No verified public proof-of-concept code is available at the time of writing. See the vendor advisory for authoritative technical details.

Detection Methods for CVE-2026-60241

Indicators of Compromise

Unexpected HTTP requests to Oracle Coherence Core endpoints from external or non-administrative source addresses.
New or unfamiliar child processes spawned by the Coherence JVM, including shells or scripting interpreters.
Outbound network connections from Coherence hosts to unknown infrastructure following inbound HTTP activity.
Modifications to Coherence cache configuration, cluster membership, or deployed classes not tied to change management.

Detection Strategies

Inspect HTTP access logs for requests to Coherence management and Core endpoints, especially from sources outside the application tier.
Correlate inbound HTTP traffic to Coherence ports with subsequent process creation events on the same host.
Alert on Java process (java) command-line anomalies originating from Coherence service accounts.
Baseline normal Coherence cluster join/leave events and flag deviations that follow external HTTP activity.

Monitoring Recommendations

Enable verbose logging on Coherence HTTP listeners and forward logs to a centralized analytics platform.
Monitor egress traffic from Fusion Middleware hosts to detect command-and-control or data exfiltration behavior.
Track file integrity on Coherence installation directories, including coherence.jar and configuration files.
Review authentication and audit trails for downstream Fusion Middleware components accessed from Coherence hosts.

How to Mitigate CVE-2026-60241

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 deployments.
Restrict network access to Coherence HTTP and cluster ports so that only trusted application servers can reach them.
Inventory all Coherence instances, including embedded deployments inside other Fusion Middleware products, and prioritize internet-exposed nodes.
Review logs for suspicious HTTP requests to Coherence endpoints prior to patching.

Patch Information

Oracle published fixes as part of the July 2026 Critical Patch Update. Refer to the Oracle Security Alert July 2026 for patch identifiers, download instructions, and any prerequisite bundles. Apply updates in accordance with Oracle's supported upgrade paths for the deployed 14.1.x or 15.1.x branch.

Workarounds

Place Coherence behind network segmentation, firewalls, or service mesh policies that block untrusted HTTP sources.
Disable Coherence HTTP endpoints that are not required for application function until patching completes.
Enforce mutual TLS or reverse-proxy authentication in front of Coherence services where architecture permits.

bash

# Example iptables rule restricting Coherence HTTP access to a trusted subnet
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP