CVE-2026-60251: Oracle Coherence RCE Vulnerability

CVE-2026-60251 Overview

CVE-2026-60251 is a critical vulnerability in the Core component of Oracle Coherence, part of the Oracle Fusion Middleware stack. The flaw allows an unauthenticated remote attacker with network access via TCP to fully compromise Oracle Coherence deployments. Successful exploitation results in complete takeover of the affected instance, impacting confidentiality, integrity, and availability. The vulnerability is classified under CWE-306: Missing Authentication for Critical Function. Oracle disclosed the issue in the Oracle Security Alert July 2026.

Critical Impact
Unauthenticated attackers can achieve full takeover of Oracle Coherence over the network with low complexity and no user interaction.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE CVE-2026-60251 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60251

Vulnerability Analysis

Oracle Coherence is a distributed in-memory data grid used to cache and process data across clustered JVMs in Oracle Fusion Middleware environments. The vulnerability resides in the Core component, which handles cluster membership, data replication, and remote invocation over TCP. Because the flaw is exploitable without credentials, any host able to reach the Coherence listener port can attempt attack traffic.

Oracle's advisory characterizes the impact as full takeover of the Coherence instance. Coherence nodes commonly run inside application servers that hold session data, cached credentials, and business objects, so a takeover propagates directly into hosted applications. The current EPSS probability is 0.358%, though exploit prediction tends to lag behind Oracle Critical Patch Update activity.

Root Cause

The issue maps to [CWE-306], missing authentication for a critical function. A network-reachable code path in the Core component processes attacker-controlled input without verifying the identity or authorization of the peer. This is consistent with historical Coherence weaknesses involving unauthenticated cluster protocols and Extend proxy endpoints.

Attack Vector

Exploitation requires only TCP reachability to a Coherence listener. An attacker sends crafted protocol traffic to the exposed port and gains control of the Coherence process. No credentials, prior foothold, or user interaction are required. Coherence clusters exposed to untrusted network segments, developer subnets, or misconfigured firewall zones are directly at risk.

No public proof-of-concept has been published at the time of writing. Technical specifics are limited to the Oracle Security Alert July 2026.

Detection Methods for CVE-2026-60251

Indicators of Compromise

Unexpected inbound TCP connections to Coherence cluster ports (default 7574 for multicast/unicast discovery and configured Extend proxy ports) from non-cluster peers.
New or unknown JVM child processes spawned by the WebLogic or Coherence server user account.
Anomalous outbound network connections from Coherence JVMs, including reverse shells or downloads to /tmp and equivalent paths.
Modifications to Coherence configuration files such as tangosol-coherence-override.xml or cache configuration XML files.

Detection Strategies

Alert on unauthenticated cluster join attempts and malformed Coherence protocol frames captured at the network boundary.
Correlate Coherence JVM process creation events with subsequent shell, scripting, or curl/wget execution to identify post-exploitation behavior.
Baseline expected Coherence peer IP addresses and flag any deviation as high-severity.

Monitoring Recommendations

Enable and forward Coherence and WebLogic server logs to a centralized SIEM for retention and correlation.
Monitor Fusion Middleware hosts for outbound traffic patterns that deviate from historical baselines.
Track file integrity on Coherence configuration directories and Java classpath locations.

How to Mitigate CVE-2026-60251

Immediate Actions Required

Apply the fixes shipped in the Oracle Critical Patch Update / Security Alert of July 2026 to all Coherence installations running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Inventory every Coherence deployment, including embedded instances inside WebLogic Server and custom applications, and confirm version and patch state.
Restrict Coherence cluster and Extend proxy ports to trusted management networks using host firewalls and network ACLs.
Rotate credentials and secrets that may have resided in Coherence caches on any node exposed to untrusted networks prior to patching.

Patch Information

Oracle addresses this vulnerability in the July 2026 Critical Patch Update. Refer to the Oracle Security Alert July 2026 for patch identifiers, download locations, and prerequisites tied to each affected release train.

Workarounds

Block Coherence cluster and Extend proxy ports at perimeter and internal firewalls so only authorized peers can connect.
Bind Coherence listeners to internal interfaces only and disable multicast discovery in favor of well-known address lists (WKA).
Enable Coherence identity and access features such as Extend proxy authentication, TLS/SSL for cluster traffic, and access controllers where the deployment supports them until patching is complete.

bash

# Example: restrict Coherence cluster port to a trusted subnet on Linux (iptables)
iptables -A INPUT -p tcp --dport 7574 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP

# Bind Coherence to a specific interface and enforce WKA in tangosol-coherence-override.xml
# -Dcoherence.localhost=10.0.10.15
# -Dcoherence.wka=10.0.10.15,10.0.10.16
# -Dcoherence.ttl=0