CVE-2026-60249: Oracle Coherence Privilege Escalation

CVE-2026-60249 Overview

CVE-2026-60249 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows a low-privileged attacker with access to the physical communication segment attached to the hardware where Oracle Coherence executes to compromise the product. Successful exploitation results in full takeover of Oracle Coherence and, because of a scope change, may significantly impact additional products in the environment. The vulnerability is mapped to improper access control [CWE-284] and affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Critical Impact
Adjacent-network attackers with low privileges can achieve full takeover of Oracle Coherence, with cascading impact on confidentiality, integrity, and availability of connected products.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60249 published to NVD
2026-07-23 - Last updated in NVD database
Referenced in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60249

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used in distributed caching and clustering. The vulnerability resides in the Core component and stems from improper access control [CWE-284] enforced on cluster communications. An attacker positioned on the same physical communication segment as a Coherence node can interact with cluster services using low-privilege credentials. Because the vulnerability triggers a scope change, exploitation impacts resources beyond Oracle Coherence itself. Attackers gain confidentiality, integrity, and availability impact against the target and adjacent products participating in the same trust boundary.

Root Cause

The root cause is insufficient access control on cluster-level operations. Coherence trusts peers on the adjacent network segment without adequate authentication or authorization checks. This trust model allows a low-privileged actor to escalate influence over the cluster and execute privileged operations that should be restricted to administrators.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must be on the same broadcast domain, VLAN, or physical segment as a Coherence node. No user interaction is required. The attack complexity is low, and only low privileges are needed. Once cluster-level trust is abused, the attacker can pivot into a full takeover of the Coherence deployment and any product relying on it for state or caching.

No verified public exploit code is available for CVE-2026-60249. Refer to the Oracle Security Alert July 2026 for vendor-provided technical details.

Detection Methods for CVE-2026-60249

Indicators of Compromise

Unexpected new cluster members joining Coherence clusters from unauthorized IP addresses on the adjacent segment.
Anomalous invocation of Coherence management operations (Invocable services, cache mutation, or extend proxy actions) from unusual peers.
Unexplained restarts, node evictions, or configuration changes in Coherence logs.

Detection Strategies

Baseline expected Coherence cluster members by hostname and IP, then alert on any deviation.
Inspect Coherence audit and JMX logs for administrative operations performed by non-administrative principals.
Monitor for lateral movement from hosts sharing the Coherence VLAN toward Fusion Middleware components.

Monitoring Recommendations

Forward Oracle Coherence, WebLogic, and Fusion Middleware logs to a centralized SIEM for correlation.
Enable network flow logging on VLANs hosting Coherence nodes to identify unauthorized peers.
Track process and network telemetry on Coherence hosts using an endpoint detection and response solution to identify post-exploitation activity.

How to Mitigate CVE-2026-60249

Immediate Actions Required

Apply the patches published in the Oracle Critical Patch Update for July 2026 to all affected Coherence versions.
Inventory every deployment of Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 across production and non-production environments.
Restrict cluster communication to dedicated, isolated network segments accessible only to authorized nodes.
Rotate credentials and cluster keys used by Coherence after patching.

Patch Information

Oracle addressed CVE-2026-60249 in the July 2026 Critical Patch Update. Refer to the Oracle Security Alert July 2026 for patch downloads and version-specific guidance.

Workarounds

Place Coherence nodes on an isolated VLAN with strict layer-2 and layer-3 access controls.
Enforce Coherence Secured Production Mode with TLS on cluster and extend traffic.
Require authentication and authorization for all Invocable and management operations, disabling any anonymous access.

bash

# Configuration example: enforce TLS and authorized hosts in tangosol-coherence-override.xml
<cluster-config>
  <authorized-hosts>
    <host-address>10.20.30.11</host-address>
    <host-address>10.20.30.12</host-address>
  </authorized-hosts>
  <socket-providers>
    <socket-provider id="tls">
      <ssl>
        <protocol>TLSv1.3</protocol>
        <identity-manager>
          <key-store>
            <url>file:/opt/coherence/certs/identity.jks</url>
            <password-provider/>
          </key-store>
        </identity-manager>
        <trust-manager>
          <key-store>
            <url>file:/opt/coherence/certs/trust.jks</url>
          </key-store>
        </trust-manager>
      </ssl>
    </socket-provider>
  </socket-providers>
</cluster-config>