CVE-2026-60244: Oracle Coherence RCE Vulnerability

CVE-2026-60244 Overview

CVE-2026-60244 is a critical vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, affecting the Core component. Supported versions 12.2.1.4.0 and 14.1.1.0.0 are affected. The flaw allows an unauthenticated remote attacker with network access via HTTP to compromise Oracle Coherence. Successful exploitation results in complete takeover of the Oracle Coherence instance, impacting confidentiality, integrity, and availability. The weakness maps to [CWE-306] Missing Authentication for Critical Function.

Critical Impact
An unauthenticated attacker can compromise Oracle Coherence over the network using HTTP, resulting in full takeover of the affected instance.

Affected Products

Oracle Coherence (Oracle Fusion Middleware) version 12.2.1.4.0
Oracle Coherence (Oracle Fusion Middleware) version 14.1.1.0.0
Component: Core

Discovery Timeline

2026-07-21 - CVE-2026-60244 published to NVD
2026-07-23 - Last updated in NVD database
July 2026 - Addressed in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60244

Vulnerability Analysis

CVE-2026-60244 is an authentication weakness in the Core component of Oracle Coherence. The affected code path exposes functionality over HTTP without enforcing authentication, allowing remote attackers to reach sensitive operations directly. Oracle categorizes the issue as easily exploitable, requiring no privileges and no user interaction.

Oracle Coherence is an in-memory data grid used to distribute application state and cache data across clustered Java Virtual Machines. Compromise of a Coherence node commonly leads to arbitrary code execution within the JVM process, giving attackers control over cached application data and downstream services. Because Coherence often stores session state, credentials, and business-critical objects, a takeover of the grid can cascade into broader Fusion Middleware compromise.

The current EPSS probability is 0.358%, indicating limited observed exploitation activity at the time of publication. No public proof-of-concept is available and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing authentication on a critical function reachable over HTTP [CWE-306]. Coherence exposes management or data-plane endpoints that do not require credentials, so any client that can reach the service port can invoke privileged operations. This class of flaw in Java middleware frequently combines with unsafe deserialization or reflective invocation paths, enabling attackers to escalate from unauthenticated access to remote code execution.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends crafted HTTP requests to a reachable Coherence endpoint without supplying credentials. Because Coherence is frequently deployed on internal networks with permissive segmentation, exposure through misconfigured load balancers, ingress controllers, or flat networks materially increases risk. Refer to the Oracle Security Alert July 2026 for authoritative technical details.

Detection Methods for CVE-2026-60244

Indicators of Compromise

Unexpected HTTP requests to Coherence management or cluster endpoints from untrusted sources.
New Java child processes spawned by the Coherence JVM, such as shells or scripting interpreters.
Outbound network connections from Coherence hosts to unknown external IPs or command-and-control infrastructure.
Unexplained modifications to cached objects, session stores, or configuration entries within the grid.

Detection Strategies

Inspect HTTP access logs on Coherence hosts for unauthenticated requests to administrative or REST endpoints.
Monitor Coherence JVMs for anomalous class loading, deserialization errors, or reflection warnings in application logs.
Alert on process lineage where the Coherence JVM spawns sh, bash, cmd.exe, powershell.exe, or compilers.
Correlate authentication-free access to Coherence with subsequent lateral movement to Fusion Middleware components.

Monitoring Recommendations

Forward Coherence, WebLogic, and host telemetry to a centralized SIEM for correlation across the middleware tier.
Baseline normal HTTP traffic to Coherence ports and alert on volume spikes or new source addresses.
Enable JVM audit logging and file integrity monitoring on Coherence configuration directories.
Continuously scan the environment for Coherence versions 12.2.1.4.0 and 14.1.1.0.0 that remain unpatched.

How to Mitigate CVE-2026-60244

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle Coherence deployments running 12.2.1.4.0 or 14.1.1.0.0.
Restrict network access to Coherence cluster and HTTP management ports to trusted management subnets only.
Audit exposure of Coherence endpoints on internet-facing load balancers, reverse proxies, and API gateways.
Review recent HTTP access and JVM logs on Coherence hosts for signs of unauthenticated interaction.

Patch Information

Oracle addressed CVE-2026-60244 in the Oracle Security Alert July 2026. Administrators should apply the corresponding Critical Patch Update for Oracle Fusion Middleware to remediate affected versions 12.2.1.4.0 and 14.1.1.0.0. Oracle recommends applying Critical Patch Updates without delay because they typically address issues that are actively targeted after disclosure.

Workarounds

Place Coherence nodes behind a network segment that denies HTTP access from untrusted sources.
Disable or firewall any Coherence HTTP or REST management endpoints that are not required for operations.
Enforce mutual TLS or an authenticating reverse proxy in front of Coherence services until patches are applied.
Reduce the attack surface by binding Coherence services to internal management interfaces rather than all interfaces.

bash

# Configuration example: restrict access to Oracle Coherence HTTP ports
# Replace <trusted_subnet> and <coherence_http_port> with environment values
iptables -A INPUT -p tcp -s <trusted_subnet> --dport <coherence_http_port> -j ACCEPT
iptables -A INPUT -p tcp --dport <coherence_http_port> -j DROP