CVE-2026-60246 Overview
CVE-2026-60246 is a missing authentication vulnerability [CWE-306] in the Core component of Oracle Coherence, a distributed in-memory data grid within Oracle Fusion Middleware. An unauthenticated attacker with network access via TCP can compromise the product without user interaction. Successful exploitation results in full takeover of Oracle Coherence, affecting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update.
Critical Impact
Remote, unauthenticated attackers can achieve complete takeover of Oracle Coherence instances reachable over TCP, exposing cached data and enabling downstream compromise of dependent Fusion Middleware services.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0 and 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60246 published to NVD as part of the Oracle Critical Patch Update
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60246
Vulnerability Analysis
Oracle Coherence uses TCP-based cluster communication for member discovery, cache replication, and remote invocations. The Core component fails to enforce authentication on network-reachable endpoints, allowing an attacker to interact with cluster services as a trusted peer. Because Coherence nodes can execute serialized payloads and remote invocation requests, unauthenticated access translates directly to product takeover.
The vulnerability is classified under [CWE-306] Missing Authentication for a Critical Function. Oracle rates the flaw as easily exploitable, requiring only network reachability to a Coherence listener port.
Root Cause
The root cause is the absence of an authentication check on a critical TCP-exposed function within the Coherence Core. Cluster and extend-client protocols accept requests without verifying the identity of the caller, so any host able to open a TCP session to the Coherence port is treated as authorized.
Attack Vector
Exploitation requires only network connectivity to the Coherence listener. The attacker sends crafted protocol messages to the unauthenticated endpoint, invoking cluster or cache operations that lead to code execution or data manipulation within the Coherence JVM. No credentials, user interaction, or prior foothold are required.
No public proof-of-concept is currently listed in the referenced advisory. Refer to the Oracle Security Alert July 2026 for vendor technical details.
Detection Methods for CVE-2026-60246
Indicators of Compromise
- Unexpected inbound TCP connections to Coherence cluster ports (default 7574) or Extend proxy ports from untrusted networks.
- New or unknown members joining the Coherence cluster, visible in Coherence management logs.
- Anomalous Java process children spawned by the Coherence JVM, such as shells or scripting interpreters.
- Outbound connections from Coherence hosts to attacker-controlled infrastructure following inbound TCP traffic.
Detection Strategies
- Alert on any external or cross-segment access to Coherence cluster and Extend ports.
- Monitor Coherence server logs for unauthenticated member joins, invocation service usage, and deserialization errors.
- Correlate JVM child-process creation with preceding network activity on Coherence ports to surface exploitation chains.
Monitoring Recommendations
- Enable verbose logging on Coherence cluster and proxy services and forward events to a centralized SIEM.
- Baseline legitimate cluster members and alert on any deviation in membership or IP origin.
- Track outbound connections from Fusion Middleware hosts and flag connections to non-approved destinations.
How to Mitigate CVE-2026-60246
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update for all affected Coherence versions without delay.
- Restrict Coherence cluster and Extend ports to trusted management networks using host and network firewalls.
- Inventory all Coherence deployments, including embedded instances in WebLogic and custom applications, to ensure complete patch coverage.
- Rotate credentials and secrets accessible from Coherence hosts if compromise is suspected.
Patch Information
Oracle addressed CVE-2026-60246 in the July 2026 Critical Patch Update. Fixes are available for Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Consult the Oracle Security Alert July 2026 for patch identifiers and installation instructions.
Workarounds
- Isolate Coherence traffic on a dedicated VLAN reachable only by authorized application servers.
- Enable Coherence Security Framework and TLS on cluster and Extend communication to require authenticated, encrypted peers.
- Disable or firewall the Extend proxy service where remote clients are not required.
# Example: restrict Coherence cluster port 7574 to trusted subnet
iptables -A INPUT -p tcp --dport 7574 -s 10.20.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
# Example: restrict Extend proxy port to application tier only
iptables -A INPUT -p tcp --dport 9099 -s 10.20.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
