CVE-2026-60257 Overview
CVE-2026-60257 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated remote attacker with network access via TCP can compromise affected Oracle Coherence instances. Successful exploitation results in a complete takeover of the Coherence deployment, impacting confidentiality, integrity, and availability.
The flaw is classified under CWE-306: Missing Authentication for Critical Function. Oracle disclosed the issue in its Oracle Security Alert July 2026.
Critical Impact
Unauthenticated attackers reachable over TCP can fully take over Oracle Coherence clusters, exposing cached data and enabling arbitrary control over in-memory data grid operations.
Affected Products
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60257 published to NVD following Oracle's July 2026 Critical Patch Update
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60257
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used for distributed caching, session management, and data federation across Java application tiers. The vulnerability resides in the Core component and permits an unauthenticated attacker to interact with a critical function over TCP without providing credentials.
The issue maps to CWE-306: Missing Authentication for Critical Function. Because Coherence cluster members exchange administrative and data operations across TCP-based cluster ports, an exposed listener without authentication allows an attacker to join or coerce cluster operations. The result is a full takeover of the Coherence instance, including read and write access to cached objects and the ability to disrupt service availability.
Current EPSS data reports a low near-term exploitation probability, and no public exploit has been published. However, historic Oracle Coherence flaws have been weaponized quickly once technical details surface.
Root Cause
The root cause is the absence of an authentication check on a critical Coherence Core function accessible over the network. Coherence cluster protocols historically trust peers reachable on the configured cluster ports, and misconfigured or default deployments do not enforce identity assertion or transport-level authentication.
Attack Vector
Exploitation requires only TCP network reachability to a Coherence cluster port or exposed service endpoint. No user interaction, credentials, or prior foothold are required. An attacker on the same network segment, or one reaching an internet-exposed Coherence port, can invoke the vulnerable function to gain control of the cluster.
No verified public proof-of-concept code is available. See the Oracle Security Alert July 2026 for vendor-provided technical guidance.
Detection Methods for CVE-2026-60257
Indicators of Compromise
- Unexpected new members joining a Coherence cluster, particularly from IP addresses outside the documented application tier.
- Anomalous cache entry modifications, deletions, or bulk reads recorded in Coherence audit or JMX metrics.
- Java process spawning child processes or opening outbound network connections from Coherence-hosting JVMs.
- Cluster restarts, partition rebalances, or availability events without corresponding operational changes.
Detection Strategies
- Inventory all Oracle Coherence deployments and identify versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 for prioritized monitoring.
- Inspect network telemetry for TCP connections to Coherence cluster ports originating from unauthorized sources.
- Correlate Coherence JVM behavior with endpoint telemetry to identify post-exploitation activity such as command execution or lateral movement.
Monitoring Recommendations
- Enable and forward Coherence cluster and JMX logs to a centralized logging or SIEM platform for retention and query.
- Alert on new cluster member joins, changes to cache configuration, and role transitions within the data grid.
- Monitor for outbound connections from Coherence hosts to untrusted destinations, which may indicate post-compromise command-and-control.
How to Mitigate CVE-2026-60257
Immediate Actions Required
- Apply the Oracle July 2026 Critical Patch Update to all Oracle Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 deployments.
- Restrict network exposure of Coherence cluster ports to trusted application-tier subnets using firewalls and security groups.
- Audit existing clusters for unauthorized members and unexpected cache state before returning them to production traffic.
Patch Information
Oracle addressed CVE-2026-60257 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for the specific patch identifiers corresponding to each affected release and apply them following Oracle's documented upgrade procedure.
Workarounds
- Enforce network segmentation so Coherence cluster ports are unreachable from user, internet, or untrusted internal networks.
- Configure Coherence Well Known Addresses (WKA) and identity assertion features to constrain cluster membership.
- Enable TLS for Coherence cluster and extend client communication to prevent unauthenticated peers from participating.
- Disable or firewall any unused management endpoints such as JMX and REST management services.
# Example: restrict Coherence cluster ports (default 7574 and dynamic range) via iptables
iptables -A INPUT -p tcp --dport 7574 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
iptables -A INPUT -p tcp --dport 8088:8090 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8088:8090 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
