CVE-2026-60247 Overview
CVE-2026-60247 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access over HTTP to fully compromise the Coherence instance. Oracle disclosed the issue in the July 2026 Critical Patch Update. Affected supported versions are 12.2.1.4.0 and 14.1.1.0.0. The vulnerability maps to [CWE-306: Missing Authentication for Critical Function], meaning security-sensitive Coherence functionality is exposed without any authentication requirement. Successful exploitation results in full takeover of Oracle Coherence, impacting confidentiality, integrity, and availability.
Critical Impact
Unauthenticated attackers reachable over HTTP can take over Oracle Coherence deployments, gaining full control of clustered in-memory data grids used by mission-critical Fusion Middleware applications.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Fusion Middleware deployments embedding these Coherence versions
Discovery Timeline
- 2026-07-21 - CVE-2026-60247 published to NVD as part of Oracle's July 2026 Critical Patch Update
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60247
Vulnerability Analysis
Oracle Coherence is a distributed in-memory data grid used by Fusion Middleware components for caching, session state, and clustered application data. This vulnerability exposes critical Coherence Core functionality over HTTP without requiring authentication. An attacker who can reach a Coherence HTTP endpoint on the network can invoke privileged operations directly.
Because the flaw is classified as Missing Authentication for Critical Function, the attacker does not need valid credentials, tokens, or session state. The exploitation path involves crafting HTTP requests to Coherence endpoints that should require authentication but do not enforce it. Successful requests grant the attacker control equivalent to a legitimate administrator of the Coherence instance.
Oracle's advisory confirms that successful attacks result in complete takeover, spanning data theft, tampering of cached records, and service disruption across the cluster. The EPSS probability at publication is 0.486%.
Root Cause
The root cause is missing authentication enforcement on network-exposed Coherence Core functionality [CWE-306]. Requests that should be gated by authentication reach privileged code paths, allowing untrusted callers to execute operations reserved for administrators.
Attack Vector
The attack vector is network-based over HTTP. An unauthenticated remote attacker with connectivity to the Coherence HTTP listener sends crafted requests to trigger the vulnerable code path. No user interaction and no prior foothold are required. Deployments that expose Coherence directly to untrusted networks, or to broad internal network segments, are at the highest risk.
No public proof-of-concept exploit is currently referenced. Full technical details are available in the Oracle Security Alert July 2026.
Detection Methods for CVE-2026-60247
Indicators of Compromise
- Unexpected HTTP requests to Coherence management or Core endpoints from unknown source addresses.
- New or modified cache entries, cluster members, or Coherence configuration changes without corresponding change tickets.
- Outbound connections initiated by the Coherence JVM process to attacker-controlled hosts.
- Spikes in Coherence process CPU, memory, or thread count coinciding with anomalous HTTP traffic.
Detection Strategies
- Inspect web server, load balancer, and WAF logs for HTTP requests targeting Coherence URIs from sources outside the expected application tier.
- Correlate Coherence audit and cluster membership logs against authenticated administrator activity to surface unauthenticated privileged actions.
- Alert on child processes spawned by the Coherence Java process, especially shells, scripting interpreters, or network utilities.
Monitoring Recommendations
- Forward Coherence, WebLogic, and reverse proxy logs to a centralized analytics platform for correlation with network telemetry.
- Monitor egress from Fusion Middleware hosts and alert on connections to non-approved destinations.
- Track Oracle CPU advisory versions in asset inventory and flag hosts still running 12.2.1.4.0 or 14.1.1.0.0 without the July 2026 patch.
How to Mitigate CVE-2026-60247
Immediate Actions Required
- Apply the Oracle July 2026 Critical Patch Update to all Coherence 12.2.1.4.0 and 14.1.1.0.0 deployments as the primary remediation.
- Inventory all Fusion Middleware environments that embed Oracle Coherence and confirm patch status.
- Restrict network access to Coherence HTTP listeners so only trusted application hosts can reach them.
- Review Coherence and host logs for indicators of prior exploitation before returning systems to production.
Patch Information
Oracle addressed CVE-2026-60247 in the July 2026 Critical Patch Update. Administrators should download and apply the Coherence patches referenced in the Oracle Security Alert July 2026. No supported workaround replaces the patch for eliminating the underlying missing-authentication condition.
Workarounds
- Place Coherence HTTP endpoints behind an authenticating reverse proxy or API gateway that enforces mutual TLS or strong authentication.
- Use firewall rules and security groups to allow HTTP access only from known application servers, blocking direct client and internet exposure.
- Disable Coherence HTTP management interfaces where they are not required by the application.
- Segment Coherence clusters onto dedicated VLANs with strict egress controls until patching is complete.
# Example: restrict Coherence HTTP port to application tier only (iptables)
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
