CVE-2026-60245 Overview
CVE-2026-60245 is a high-severity vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low-privileged attacker with logon access to the infrastructure running Oracle Coherence can compromise the product when a separate user performs a required interaction. The vulnerability carries a scope change, meaning successful exploitation can impact additional products beyond Oracle Coherence. It maps to [CWE-284: Improper Access Control].
Critical Impact
Successful exploitation permits unauthorized creation, deletion, or modification of critical data and unauthorized read access to all Oracle Coherence accessible data.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0, 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60245 published to NVD
- 2026-07-23 - Last updated in NVD database
- July 2026 - Addressed in the Oracle Critical Patch Update
Technical Details for CVE-2026-60245
Vulnerability Analysis
The vulnerability resides in the Core component of Oracle Coherence, Oracle's in-memory data grid used for distributed caching, computation, and storage across Fusion Middleware deployments. The weakness is classified as improper access control [CWE-284], allowing an authenticated local user to influence Coherence operations in ways the access model should prevent.
Exploitation is difficult and requires user interaction from a party other than the attacker. Because the vulnerability produces a scope change, a successful attack against Coherence can extend impact to other products relying on it. Impact is limited to confidentiality and integrity; availability is not affected.
Root Cause
The root cause is an improper access control condition in the Core component of Oracle Coherence. Oracle has not published low-level technical details beyond the July 2026 Critical Patch Update advisory. The scope change indicates that the vulnerable code path can influence security decisions outside the immediate Coherence boundary.
Attack Vector
The attack vector is local. An attacker must already possess valid low-privilege credentials and logon access to the host running Oracle Coherence. The attacker must also induce a second user to perform an action for exploitation to succeed, consistent with a social engineering or user-triggered code path. High attack complexity reflects the required timing and preconditions.
No public proof-of-concept exploit is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and the EPSS probability remains low as of the published date. See the Oracle Critical Patch Update advisory for vendor-supplied details.
Detection Methods for CVE-2026-60245
Indicators of Compromise
- Unexpected modification, creation, or deletion of Oracle Coherence cache entries or configuration data by low-privileged accounts.
- Anomalous local logons to Coherence hosts followed by process activity involving Coherence JVMs.
- Access patterns in Coherence audit logs that indicate cross-scope data access affecting downstream Fusion Middleware components.
Detection Strategies
- Compare installed Oracle Coherence build identifiers against the fixed versions listed in the July 2026 Oracle Critical Patch Update.
- Correlate local user authentication events on Coherence hosts with subsequent Coherence administrative or data-mutation operations.
- Alert on Coherence operations triggered shortly after a second user session initiates an unusual action, matching the human-interaction precondition.
Monitoring Recommendations
- Enable and centralize Oracle Coherence audit logging and JVM process telemetry to a SIEM for retention and analytics.
- Monitor operating system logs on Coherence servers for interactive logons by service or low-privilege accounts.
- Track integrity of Coherence configuration files and cluster membership changes with file integrity monitoring.
How to Mitigate CVE-2026-60245
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update for Oracle Coherence to versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
- Inventory all Coherence deployments across Fusion Middleware environments and prioritize internet-adjacent or shared-tenancy hosts.
- Review and reduce local logon rights on Coherence hosts to only required administrators and service accounts.
Patch Information
Oracle addressed CVE-2026-60245 in the July 2026 Critical Patch Update. Refer to the Oracle Critical Patch Update advisory for the specific patch bundle applicable to each supported Coherence version and for prerequisites related to Fusion Middleware stacks.
Workarounds
- Restrict interactive and remote logon to Coherence hosts using operating system access controls and jump-host requirements.
- Enforce least privilege on Coherence roles and remove unnecessary application accounts that can authenticate to the cluster.
- Provide user awareness guidance for administrators who interact with Coherence tooling, since exploitation requires action from a second user.
# Verify installed Oracle Coherence version prior to and after patching
java -cp coherence.jar com.tangosol.net.CacheFactory -version
# Restrict interactive logon on Linux Coherence hosts to an allowlisted group
sudo groupadd coherence-admins
sudo usermod -aG coherence-admins <admin-user>
echo "auth required pam_access.so" | sudo tee -a /etc/pam.d/login
echo "-:ALL EXCEPT root coherence-admins:ALL" | sudo tee -a /etc/security/access.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
