CVE-2026-60256 Overview
CVE-2026-60256 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful exploitation results in full takeover of the affected instance, with high impact on confidentiality, integrity, and availability. Oracle disclosed the vulnerability in the July 2026 Critical Patch Update. The weakness is classified as [CWE-306] Missing Authentication for Critical Function.
Critical Impact
An unauthenticated remote attacker can achieve complete takeover of Oracle Coherence over TCP without user interaction, exposing enterprise cache clusters and dependent Fusion Middleware workloads.
Affected Products
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60256 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60256
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used for distributed caching and application state management in Oracle Fusion Middleware deployments. The vulnerability resides in the Core component and can be triggered by an unauthenticated attacker with only TCP-level network reachability to the Coherence service. Oracle categorizes the flaw as easily exploitable and confirms it yields complete takeover of the Coherence process. The attack requires no user interaction and no prior privileges on the target.
Root Cause
The root cause is a missing authentication check on a critical function [CWE-306]. Coherence cluster and management endpoints accept operations over TCP without verifying the identity of the caller. Because Coherence nodes typically process serialized objects and cluster control messages with high privilege inside the JVM, an unauthenticated request handler that reaches sensitive code paths permits an attacker to influence application state or execution.
Attack Vector
Exploitation occurs over the network via TCP against the Coherence listener. An attacker who can reach the cluster port sends crafted traffic that invokes privileged operations without authenticating. Because Coherence clusters are often deployed on internal networks with weak segmentation, adjacent workloads, exposed management interfaces, or misconfigured perimeter rules can extend the attack surface. Oracle's July 2026 Critical Patch Update advisory documents the affected component and fixed versions. See the Oracle Security Alert CPU July 2026 for vendor-supplied technical context.
No public proof-of-concept is available at the time of publication, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is 0.486%.
Detection Methods for CVE-2026-60256
Indicators of Compromise
- Unexpected inbound TCP connections to Coherence cluster ports (default 7574 for Coherence Extend and cluster multicast/unicast ports) from unmanaged or external sources.
- New or unusual child processes spawned by the Coherence JVM, such as shells, curl, wget, or scripting interpreters.
- Anomalous outbound network connections initiated by the WebLogic or Coherence Java process to attacker-controlled infrastructure.
- Modifications to Coherence configuration files (tangosol-coherence-override.xml, coherence-cache-config.xml) not tied to a change ticket.
Detection Strategies
- Monitor Java process behavior on Coherence nodes for deserialization exceptions, class loading anomalies, and unexpected reflective calls in application and JVM logs.
- Alert on network flows to Coherence ports originating from outside the defined cluster CIDR or from workloads that do not participate in the grid.
- Correlate authentication-less access attempts on Fusion Middleware hosts with subsequent process, file, or registry changes on the same endpoint.
Monitoring Recommendations
- Ingest Coherence, WebLogic, and host telemetry into a centralized data lake and apply behavioral analytics for post-exploitation activity such as credential access and lateral movement.
- Enable JVM audit logging and capture stdout/stderr of the Coherence process for offline analysis.
- Baseline normal cluster traffic patterns and alert on deviations in packet size, protocol, or connection rate on Coherence listener ports.
How to Mitigate CVE-2026-60256
Immediate Actions Required
- Apply the Oracle July 2026 Critical Patch Update to all Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 deployments without delay.
- Inventory all Fusion Middleware hosts running Coherence, including embedded instances inside WebLogic Server domains.
- Restrict inbound TCP access to Coherence cluster ports to authorized cluster members only using host and network firewalls.
- Rotate credentials, keys, and secrets accessible to any Coherence node that cannot be immediately patched.
Patch Information
Oracle addresses CVE-2026-60256 in the July 2026 Critical Patch Update. Administrators should follow the patch matrix in the Oracle Security Alert CPU July 2026 advisory for exact package identifiers and prerequisites. Coherence patches are typically delivered through OPatch and require a rolling restart of cluster members.
Workarounds
- Isolate Coherence clusters on dedicated network segments with no direct exposure to user networks or the internet.
- Enforce mutual TLS on Coherence Extend and cluster communications where supported, and disable any unauthenticated management endpoints.
- Configure Coherence to use a well-known Coherence Security Framework (CSF) policy that requires authentication for cache and invocation service access.
- Place a deny-by-default rule at the perimeter and internal segmentation points for Coherence TCP ports until patching completes.
# Example iptables rule restricting Coherence port 7574 to cluster members only
iptables -A INPUT -p tcp --dport 7574 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
