CVE-2026-60258 Overview
CVE-2026-60258 is a critical vulnerability in Oracle Coherence, a component of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence and achieve full product takeover. Oracle disclosed the issue in the Oracle July 2026 Security Alert. The vulnerability is classified under [CWE-306] Missing Authentication for Critical Function. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Critical Impact
An unauthenticated remote attacker can take over Oracle Coherence over TCP, resulting in full compromise of confidentiality, integrity, and availability.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0 and 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60258 published to the National Vulnerability Database (NVD)
- 2026-07-21 - Oracle publishes the Oracle July 2026 Security Alert containing the patch
- 2026-07-23 - Entry last modified in the NVD database
Technical Details for CVE-2026-60258
Vulnerability Analysis
Oracle Coherence is a distributed in-memory data grid used for caching and clustering across Oracle Fusion Middleware deployments. The vulnerability resides in the Core component of Oracle Coherence and is reachable over TCP without authentication. Oracle describes the issue as easily exploitable, meaning no specialized conditions or user interaction are required to trigger it.
Successful exploitation results in complete takeover of the Coherence instance. An attacker gains the ability to read cluster data, modify cached objects, and disrupt availability of applications relying on the grid. Coherence typically runs alongside high-value application tiers, so a compromised node often provides access to sensitive business data and inter-service traffic.
Oracle categorizes the impact as high across confidentiality, integrity, and availability, consistent with a full product compromise rather than a limited disclosure or denial-of-service outcome.
Root Cause
The underlying weakness maps to [CWE-306] Missing Authentication for Critical Function. A critical Coherence code path exposed over TCP does not enforce authentication before processing requests, allowing untrusted clients to invoke privileged functionality. Historically, similar Coherence issues have involved unsafe handling of Java serialized objects transmitted over cluster ports.
Attack Vector
Attackers require only network reachability to a Coherence TCP listener, typically the cluster or Extend proxy port. Once a TCP session is established, the attacker submits crafted traffic that the Core component processes without validating the caller. Because Coherence ports are frequently exposed within internal networks or, in misconfigured deployments, to broader segments, the practical exposure is significant.
No verified public exploit code was available at the time of publication. Refer to the Oracle July 2026 Security Alert for authoritative technical detail.
Detection Methods for CVE-2026-60258
Indicators of Compromise
- Unexpected inbound TCP connections to Coherence cluster or Extend proxy ports from hosts that are not authorized cluster members.
- New or modified Java processes spawned by the Coherence JVM, particularly child shells or java invocations with unusual classpaths.
- Anomalous outbound network traffic from Coherence servers to attacker-controlled infrastructure following inbound TCP activity.
- Cluster membership changes, node join events, or configuration reloads that do not correspond to planned operational activity.
Detection Strategies
- Inspect Coherence and WebLogic logs for deserialization errors, unexpected class loading, or invocation traces originating from remote peers.
- Correlate process creation telemetry on Coherence hosts against known-good baselines to surface post-exploitation command execution.
- Alert on privileged Coherence service accounts executing interactive commands or writing to non-standard filesystem paths.
Monitoring Recommendations
- Enable verbose audit logging for the Coherence Core component and forward logs to a centralized analytics platform.
- Monitor TCP flow data for Coherence ports and flag connections that violate documented cluster topology.
- Track patch state of Oracle Fusion Middleware components to detect hosts still running vulnerable Coherence versions.
How to Mitigate CVE-2026-60258
Immediate Actions Required
- Apply the July 2026 Critical Patch Update from Oracle to all affected Coherence installations without delay.
- Inventory every Coherence deployment at versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 and prioritize internet-adjacent nodes.
- Restrict TCP access to Coherence cluster and proxy ports so only authorized cluster members and application tiers can connect.
- Rotate credentials and secrets held in Coherence caches if compromise cannot be ruled out.
Patch Information
Oracle released fixes for CVE-2026-60258 in the July 2026 Critical Patch Update. Administrators should consult the Oracle July 2026 Security Alert for patch identifiers and installation instructions specific to each affected Coherence release.
Workarounds
- Place Coherence nodes behind strict network segmentation and firewall rules that block untrusted TCP access to cluster and Extend ports.
- Disable or restrict Extend proxy services on nodes that do not require external client access.
- Enforce TLS and mutual authentication for Coherence Extend clients where the deployment supports it, pending patch installation.
# Example iptables rule restricting Coherence cluster port access to trusted subnets
iptables -A INPUT -p tcp --dport 7574 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
