CVE-2026-60242 Overview
CVE-2026-60242 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker with HTTP network access to compromise Oracle Coherence. Successful exploitation results in complete takeover of the affected Coherence instance, impacting confidentiality, integrity, and availability. Oracle Coherence versions 12.2.1.4.0 and 14.1.1.0.0 are affected. The underlying weakness is classified as Missing Authentication for Critical Function [CWE-306], meaning the product exposes critical functionality without verifying the identity of the requester.
Critical Impact
An unauthenticated attacker with only network access via HTTP can fully compromise Oracle Coherence and take over the affected system.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Fusion Middleware deployments embedding these Coherence versions
Discovery Timeline
- 2026-07-21 - CVE-2026-60242 published to NVD
- 2026-07-21 - Oracle publishes Security Alert covering the July 2026 patch cycle
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60242
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used inside Oracle Fusion Middleware for distributed caching and clustering. This vulnerability sits in the Core component and is reachable over HTTP without any credentials or user interaction. An attacker on the network can send crafted requests directly to a Coherence endpoint and gain control over the process, leading to full compromise of the data grid and any data or systems it fronts.
Because Coherence often serves as a shared caching and coordination layer for other Fusion Middleware services, a successful exploit typically provides pivot points into WebLogic, application servers, and backend datastores. Attackers can read cached data, tamper with session or business state, and execute code within the Coherence JVM context.
Root Cause
The issue maps to [CWE-306] Missing Authentication for Critical Function. Coherence exposes a critical function over the network without enforcing authentication, so any client that can reach the HTTP interface is treated as trusted. Oracle has not published a full technical breakdown of the internal call path in the public advisory.
Attack Vector
The attack vector is Network (HTTP), attack complexity is Low, and no privileges or user interaction are required. Any host that can reach the Coherence HTTP listener, including through misconfigured load balancers or exposed management ports, is in scope. Refer to the Oracle Security Alert July 2026 for authoritative technical details.
Detection Methods for CVE-2026-60242
Indicators of Compromise
- Unauthenticated HTTP requests to Oracle Coherence management or cluster endpoints from unexpected source addresses.
- New or unexpected child processes spawned by the Coherence JVM, including shells or scripting interpreters.
- Outbound network connections from Coherence hosts to unknown external IPs shortly after inbound HTTP traffic.
- Unexplained modifications to cached objects, cluster membership changes, or new Coherence extend clients.
Detection Strategies
- Inspect HTTP access logs on Coherence and any fronting proxies for anomalous URIs targeting management or cluster interfaces.
- Correlate JVM process telemetry with inbound network events to identify request-driven code execution attempts.
- Alert on Coherence hosts making outbound connections that deviate from an established baseline of cluster peers and backends.
Monitoring Recommendations
- Enable verbose access logging on all Coherence HTTP endpoints and centralize logs for retention and search.
- Monitor authentication failures and, more importantly, successful unauthenticated calls to sensitive Coherence functions.
- Track version and patch level of every Coherence node against the Oracle Critical Patch Update baseline.
How to Mitigate CVE-2026-60242
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Coherence 12.2.1.4.0 and 14.1.1.0.0 deployments.
- Restrict network access to Coherence HTTP endpoints so they are reachable only from trusted management and application subnets.
- Inventory all Fusion Middleware deployments that embed Coherence and confirm their patch status.
- Review recent HTTP access and JVM logs on Coherence hosts for signs of pre-patch exploitation.
Patch Information
Oracle addressed this vulnerability in the July 2026 Critical Patch Update. Administrators should download and apply the fixes referenced in the Oracle Security Alert July 2026 for each affected Coherence version. No official workarounds replace patching, and Oracle recommends applying Critical Patch Update fixes without delay.
Workarounds
- Block external and untrusted internal access to Coherence HTTP ports using host and network firewalls.
- Place Coherence management interfaces behind an authenticating reverse proxy or VPN until patches are deployed.
- Disable any Coherence HTTP services that are not strictly required by the application architecture.
# Example: restrict Coherence HTTP access to a trusted management subnet
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
