CVE-2026-60254: Oracle Coherence RCE Vulnerability

CVE-2026-60254 Overview

CVE-2026-60254 is a critical authentication bypass vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. Unauthenticated attackers with network access via TCP can compromise Oracle Coherence without user interaction. Successful exploitation results in complete takeover of the affected Coherence instance, impacting confidentiality, integrity, and availability.

The vulnerability is classified as [CWE-306] Missing Authentication for Critical Function. Affected supported versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
An unauthenticated remote attacker can achieve full takeover of Oracle Coherence over TCP, exposing distributed cache data and enabling lateral movement into the Fusion Middleware stack.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60254 published to NVD following the Oracle July 2026 Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60254

Vulnerability Analysis

Oracle Coherence is a distributed in-memory data grid used in Fusion Middleware deployments for caching, session replication, and distributed processing. Cluster members communicate over TCP using Coherence's Tangosol Cluster Management Protocol (TCMP) and extend proxy services. This vulnerability allows an unauthenticated attacker to reach a critical function that should require authentication.

The attack requires only network reachability to a Coherence TCP listener. No credentials, privileges, or user interaction are needed. A successful attack yields high-impact compromise across confidentiality, integrity, and availability — effectively a full takeover of the Coherence instance and the data it holds.

The EPSS probability is 0.486% (percentile 39.031) as of 2026-07-23. No public proof-of-concept, exploit database entry, or CISA KEV listing exists at time of publication.

Root Cause

The root cause is mapped to [CWE-306] Missing Authentication for Critical Function. A critical operation exposed by the Coherence Core is reachable over TCP without an authentication check, allowing an attacker to invoke privileged functionality reserved for cluster members or administrators.

Attack Vector

Exploitation is network-based and low complexity. An attacker sends crafted traffic to an exposed Coherence TCP port — commonly the cluster port or an extend proxy listener — and triggers the unauthenticated code path. Because Coherence clusters frequently run inside application server tiers with wide internal network reach, a foothold on any adjacent host is often sufficient to reach the vulnerable service.

No verified exploit code is available. Refer to the Oracle Critical Patch Update - July 2026 for vendor-authoritative technical guidance.

Detection Methods for CVE-2026-60254

Indicators of Compromise

Unexpected TCP connections to Coherence cluster ports or extend proxy listeners from hosts outside the defined cluster membership.
New or unexpected Java processes, class loading, or child processes spawned by the WebLogic or Coherence JVM.
Anomalous outbound network connections from Coherence JVM processes, indicating post-exploitation command-and-control or data exfiltration.
Coherence log entries showing unauthenticated management or invocation service requests from unknown peers.

Detection Strategies

Inventory all Coherence deployments and their exposed TCP ports, then baseline expected cluster peers to flag connections from unauthorized sources.
Monitor Coherence and WebLogic logs for invocation service, management, or cluster-join events lacking valid authenticated identities.
Alert on process lineage anomalies where the Coherence JVM spawns shells, scripting interpreters, or download utilities.
Correlate network telemetry with endpoint telemetry to identify TCP exploitation attempts followed by suspicious host behavior.

Monitoring Recommendations

Ingest Coherence, WebLogic, and host telemetry into a centralized data lake or SIEM for cross-source correlation and retention.
Enable behavioral monitoring on Fusion Middleware hosts to detect post-exploitation activity such as credential access or lateral movement.
Track egress traffic from application server subnets and alert on connections to unrecognized external destinations.

How to Mitigate CVE-2026-60254

Immediate Actions Required

Apply the fixes from the Oracle July 2026 Critical Patch Update to all affected Coherence versions without delay.
Restrict network access to Coherence TCP ports so that only authorized cluster members and application tiers can reach them.
Audit Coherence deployments for exposure to untrusted networks, including cloud security groups and internal segmentation gaps.
Review Coherence and WebLogic logs for signs of prior unauthenticated access attempts.

Patch Information

Oracle released fixes for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 in the Oracle Critical Patch Update - July 2026. Administrators should follow Oracle's advisory to identify the correct patch bundle for each Fusion Middleware release and apply it during a controlled maintenance window.

Workarounds

Place Coherence cluster and extend proxy ports behind strict host-based firewalls or network ACLs that permit only known cluster peers.
Terminate exposure of Coherence services to the public internet or untrusted VPCs until patching is complete.
Where supported, enable Coherence Extend TLS with client authentication and identity token support to add a defense layer around proxy listeners.

bash

# Example iptables rule restricting Coherence cluster port 7574 to known peers
iptables -A INPUT -p tcp --dport 7574 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP