CVE-2026-60253 Overview
CVE-2026-60253 is a critical authentication bypass vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker with network access via TCP to fully compromise Oracle Coherence instances. Oracle disclosed the issue in the July 2026 Critical Patch Update. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability is classified under CWE-306: Missing Authentication for Critical Function.
Critical Impact
Unauthenticated attackers can achieve complete takeover of Oracle Coherence servers over the network, resulting in loss of confidentiality, integrity, and availability.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60253 published to NVD as part of the Oracle Critical Patch Update July 2026
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60253
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used for distributed caching, stateful session management, and low-latency data access in enterprise Java environments. The Core component exposes cluster communication and management functions over TCP. CVE-2026-60253 stems from missing authentication on a critical function reachable through this network interface.
An attacker who can reach a Coherence node over the network can interact with sensitive cluster operations without presenting credentials. Successful exploitation results in full takeover of the Coherence instance, allowing the attacker to read cached data, tamper with stored objects, disrupt cluster availability, and pivot into downstream Fusion Middleware components that depend on Coherence.
Because Coherence is often embedded within WebLogic Server, Identity Management, and other Fusion Middleware stacks, compromise typically extends beyond the caching layer to hosted application data and credentials.
Root Cause
The root cause is a Missing Authentication for Critical Function weakness [CWE-306]. A sensitive Coherence operation exposed on a TCP listener does not verify the caller's identity before executing privileged actions. This allows any client capable of establishing a TCP connection to invoke the function directly.
Attack Vector
The attack vector is remote and network based. No credentials, user interaction, or prior foothold are required. An attacker only needs TCP reachability to a Coherence port on a vulnerable node. In typical deployments, this includes Coherence cluster ports and management endpoints that are often exposed on internal networks and, in misconfigured environments, to the internet.
Refer to the Oracle Critical Patch Update July 2026 advisory for technical details. No public proof-of-concept exploit has been confirmed at the time of publication.
Detection Methods for CVE-2026-60253
Indicators of Compromise
- Unexpected TCP connections from unknown external or internal hosts to Coherence cluster and Extend proxy ports.
- New or modified cached objects, unexpected cluster membership changes, or unauthorized MBean invocations in Coherence logs.
- Java processes spawning shells, powershell.exe, or cmd.exe from Coherence or WebLogic service accounts.
- Outbound connections from Coherence hosts to unfamiliar IP addresses immediately following inbound TCP activity.
Detection Strategies
- Monitor Oracle Coherence and WebLogic logs for authentication anomalies, unexpected cluster join events, and management operations from non-cluster hosts.
- Baseline TCP traffic to Coherence ports and alert on connections from IP addresses outside the approved cluster membership.
- Deploy behavioral endpoint detection on Coherence hosts to identify post-exploitation activity such as child process creation from the Java runtime.
- Correlate network flow data with process telemetry to surface attacker sessions that bypass authentication.
Monitoring Recommendations
- Enable verbose Coherence audit logging and forward events to a centralized SIEM for retention and correlation.
- Track outbound connections initiated by Coherence JVMs, which should normally be limited to cluster peers and known dependencies.
- Alert on Coherence configuration changes, especially modifications to cluster join policies and Extend proxy settings.
How to Mitigate CVE-2026-60253
Immediate Actions Required
- Apply the Oracle July 2026 Critical Patch Update to all Coherence instances running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
- Inventory all Fusion Middleware deployments that embed Coherence, including WebLogic, Identity Management, and custom applications.
- Restrict Coherence TCP ports to trusted cluster members using host firewalls and network segmentation.
- Review recent logs on exposed Coherence nodes for signs of prior exploitation.
Patch Information
Oracle addressed CVE-2026-60253 in the Oracle Critical Patch Update July 2026. Administrators should apply the CPU immediately and follow Oracle's documented post-patch verification steps. There are no partial mitigations that substitute for the patch.
Workarounds
- Isolate Coherence cluster and Extend proxy ports behind firewalls that permit traffic only from authorized cluster members and application tiers.
- Disable or block internet exposure of any Coherence TCP listener until patching is complete.
- Enforce mutual TLS on Coherence Extend and cluster communication where supported by the deployed version.
- Rotate credentials and cryptographic material stored in Coherence caches after patching if compromise is suspected.
# Example iptables rule limiting Coherence cluster port 7574 to trusted subnet
iptables -A INPUT -p tcp --dport 7574 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
