CVE-2026-60250: Oracle Coherence RCE Vulnerability

CVE-2026-60250 Overview

CVE-2026-60250 is a missing authentication vulnerability [CWE-306] in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via TCP can compromise Oracle Coherence and achieve full product takeover. The vulnerability affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle disclosed the issue in the July 2026 Critical Patch Update. The flaw has an EPSS probability of 0.358% at the 28th percentile as of 2026-07-23.

Critical Impact
An unauthenticated remote attacker can take over Oracle Coherence instances with full confidentiality, integrity, and availability impact.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60250 published to NVD following Oracle's July 2026 Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60250

Vulnerability Analysis

CVE-2026-60250 resides in the Core component of Oracle Coherence, the in-memory data grid used by Oracle Fusion Middleware for distributed caching and scale-out processing. The flaw allows an unauthenticated attacker with TCP network reachability to compromise the product. Successful exploitation yields complete takeover of the affected Coherence instance, including access to cached data, cluster operations, and any workloads driven by the grid.

The vulnerability is classified as Missing Authentication for a Critical Function [CWE-306]. Oracle rates exploitation as easy, requiring no privileges and no user interaction. Because Coherence clusters typically hold session state, business objects, and cache data for upstream applications, a takeover exposes downstream Fusion Middleware components as well.

Root Cause

The root cause is the absence of authentication enforcement on a network-exposed function within Coherence Core. TCP-reachable operations that should require authentication accept requests from any client. This class of flaw is common in clustering and cache protocols originally designed for trusted internal networks that later become exposed to broader networks.

Attack Vector

Exploitation requires only network access to a Coherence cluster port over TCP. The attacker sends crafted protocol traffic to the exposed listener and gains control of the Coherence process. No credentials, session, or victim interaction is required. Oracle's advisory confirms the impact as product takeover, meaning attackers can manipulate cluster state, exfiltrate cached data, and execute code within the Coherence process context.

No public exploit or proof-of-concept has been observed as of the last modification date. Refer to the Oracle Security Alert July 2026 for authoritative technical details.

Detection Methods for CVE-2026-60250

Indicators of Compromise

Unexpected TCP connections to Coherence cluster ports (default 9099 for management, and configured Coherence Extend/TCMP ports) from untrusted networks.
Anomalous cluster membership changes or new node join events in Coherence logs without matching change tickets.
Unexpected child processes spawned by the Coherence JVM or unusual outbound connections from the Coherence host.

Detection Strategies

Inventory all Coherence deployments and confirm versions against 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Monitor Coherence audit and cluster logs for join, invocation, and management operations originating from unknown IP addresses.
Alert on any Coherence listener port reachable from outside the designated cluster subnet using network flow data.

Monitoring Recommendations

Enable verbose Coherence logging for cluster membership and Extend client operations, and forward to a centralized log platform.
Baseline normal JVM behavior for Coherence hosts and alert on deviations such as new listening sockets or shell process creation.
Continuously validate that firewall rules restrict Coherence TCP ports to authorized cluster members and application servers.

How to Mitigate CVE-2026-60250

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Coherence instances running affected versions.
Restrict TCP access to Coherence cluster and Extend ports at the network layer to authorized hosts only.
Audit exposed Coherence endpoints and take internet-facing instances offline until patched.

Patch Information

Oracle addressed CVE-2026-60250 in the Oracle Security Alert July 2026. Administrators must apply the Critical Patch Update for Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Follow Oracle's documented patching procedure and restart cluster members in a controlled rolling sequence.

Workarounds

Isolate Coherence clusters on dedicated management VLANs with strict ingress filtering to trusted application servers.
Enable Coherence security features including identity assertion, TLS for TCMP and Extend, and access controllers where supported by the deployment.
Where patching is delayed, block Coherence TCP ports at host and perimeter firewalls for any source outside the cluster boundary.

bash

# Example: restrict Coherence Extend port to a trusted app-tier subnet
iptables -A INPUT -p tcp --dport 9099 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP