CVE-2026-60248: Oracle Coherence Privilege Escalation Flaw

CVE-2026-60248 Overview

CVE-2026-60248 is a privilege management flaw in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The vulnerability affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker with logon access to the infrastructure where Oracle Coherence executes can compromise the product. The flaw carries a scope change, meaning successful exploitation impacts resources beyond Oracle Coherence itself. Oracle disclosed the issue in the Oracle Security Alert July 2026. The weakness maps to [CWE-269] Improper Privilege Management.

Critical Impact
Successful attacks result in full takeover of Oracle Coherence with high impact to confidentiality, integrity, and availability, and effects extending to adjacent components through scope change.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60248 published to NVD following Oracle Critical Patch Update disclosure
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60248

Vulnerability Analysis

The flaw resides in the Core component of Oracle Coherence, Oracle's in-memory data grid product used for distributed caching and application state management across Oracle Fusion Middleware deployments. The vulnerability is classified as Improper Privilege Management [CWE-269]. An attacker who can log on to the underlying host where Oracle Coherence runs can leverage the flaw to take control of the Coherence process. Because Coherence typically clusters with other Fusion Middleware components and stores application state, compromise of the service exposes downstream systems that trust the cache tier.

The scope change indicated in the CVSS vector reflects that the impact crosses a security authority boundary. An attacker compromising Coherence can pivot into other Fusion Middleware products that consume its data or share its runtime environment.

Root Cause

The root cause is improper enforcement of privilege boundaries within the Coherence Core component. The service does not adequately restrict actions available to an attacker who holds local logon access but lacks Coherence-level authentication. This allows unauthenticated local actions to escalate into administrative control of the Coherence instance.

Attack Vector

Exploitation requires local access to the infrastructure hosting Oracle Coherence, such as a shell session on the host or an adjacent process within the same trust boundary. No user interaction and no prior authentication to Coherence are required. The low attack complexity means an attacker with a foothold on the host can reliably trigger the flaw.

No verified public proof-of-concept code is available at the time of publication. Refer to the Oracle Security Alert July 2026 for vendor-provided technical detail.

Detection Methods for CVE-2026-60248

Indicators of Compromise

Unexpected Coherence cluster membership changes or new nodes joining without change-control approval.
Coherence process spawning shells, scripts, or child processes that deviate from the baseline JVM behavior.
Configuration or MBean modifications on Coherence management endpoints performed outside sanctioned maintenance windows.
Local user sessions on Coherence hosts that interact with Coherence sockets, pipes, or on-disk artifacts without a corresponding change ticket.

Detection Strategies

Baseline the Coherence JVM process tree and alert on any deviation, particularly child process creation from the Coherence runtime.
Monitor Oracle Fusion Middleware audit logs for privilege changes and administrative operations that lack a corresponding authenticated session.
Correlate local logon events on Coherence hosts with subsequent Coherence management activity to spot unauthenticated escalations.

Monitoring Recommendations

Enable JMX and Coherence management auditing and forward events to a centralized SIEM for correlation.
Track file integrity on Coherence configuration files, cache configuration XML, and startup scripts.
Alert on outbound connections from Coherence hosts that deviate from documented cluster and client topology.

How to Mitigate CVE-2026-60248

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes for Oracle Coherence to all affected versions without delay.
Inventory every Oracle Coherence deployment, including embedded uses inside other Fusion Middleware products, and confirm patch status.
Restrict interactive and service-account logon rights on Coherence hosts to a minimal set of administrators.
Segment Coherence hosts on the network so that only application tiers requiring cache access can reach them.

Patch Information

Oracle addressed CVE-2026-60248 in the July 2026 Critical Patch Update. Patch details, affected downloads, and post-patch verification steps are published in the Oracle Security Alert July 2026. Administrators should schedule patch application for all listed versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Workarounds

Enforce strict operating-system-level access controls on Coherence hosts to reduce the population of users who can trigger the local vector.
Disable or firewall Coherence management interfaces from untrusted local users until patches are applied.
Run Coherence under a dedicated, least-privileged service account with no shared home directory or writable paths beyond required data directories.

bash

# Example: restrict interactive logon and network exposure on a Coherence host
# Limit SSH access to administrators only
sudo groupadd coherence-admins
sudo usermod -aG coherence-admins <admin-user>
echo "AllowGroups coherence-admins" | sudo tee -a /etc/ssh/sshd_config
sudo systemctl restart sshd

# Restrict Coherence management ports to the application subnet
sudo firewall-cmd --permanent --add-rich-rule=\
  'rule family="ipv4" source address="10.20.0.0/24" port port="9099" protocol="tcp" accept'
sudo firewall-cmd --permanent --add-rich-rule=\
  'rule family="ipv4" port port="9099" protocol="tcp" drop'
sudo firewall-cmd --reload