CVE-2026-60259: Oracle Coherence RCE Vulnerability

CVE-2026-60259 Overview

CVE-2026-60259 is a critical missing authentication vulnerability [CWE-306] in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker with network access via HTTP can exploit this issue to fully compromise Oracle Coherence. Oracle addressed the vulnerability in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation results in complete takeover of Oracle Coherence, with high impact to confidentiality, integrity, and availability.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60259 published to the National Vulnerability Database (NVD)
July 2026 - Oracle released fixes in the Oracle Critical Patch Update July 2026
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60259

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used by Oracle Fusion Middleware for distributed caching, session replication, and application state management. The vulnerability resides in the Core component and is exposed over HTTP. An attacker can reach the affected endpoint across the network without any credentials or user interaction.

Oracle categorizes the issue as easily exploitable. Because Coherence clusters frequently store session data, cached credentials, and application objects, a successful takeover exposes the entire data grid and any application relying on it. The scope is unchanged, but the confidentiality, integrity, and availability impacts are all rated high.

Root Cause

The root cause is classified as Missing Authentication for a Critical Function [CWE-306]. A Coherence HTTP-facing function does not verify the identity of the caller before performing privileged operations. Any client able to reach the service over the network can invoke functionality that should require authentication, leading to full compromise of the Coherence instance.

Attack Vector

The attack vector is network-based (AV:N) over HTTP with no privileges and no user interaction required. An attacker sends crafted HTTP requests to an exposed Coherence endpoint. Because Coherence is typically embedded within WebLogic Server, Fusion Applications, and other Oracle middleware stacks, exposure can occur through management interfaces, cluster ports, or reverse-proxied HTTP paths that were not intended to be reachable from untrusted networks.

No public proof-of-concept is currently listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list. The current EPSS probability is 0.486%. Refer to the Oracle Critical Patch Update July 2026 for vendor technical details.

Detection Methods for CVE-2026-60259

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Coherence management or REST endpoints originating from untrusted networks.
New or unexpected Coherence cluster members joining the grid, or unexpected cache mutations across Coherence nodes.
Spawned child processes from the Coherence or WebLogic JVM, such as shells, cmd.exe, or scripting interpreters.
Outbound connections from Coherence hosts to unfamiliar external IP addresses following inbound HTTP activity.

Detection Strategies

Inventory all Oracle Fusion Middleware deployments and identify Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Inspect HTTP access logs on WebLogic and Coherence hosts for anomalous requests to Coherence REST, management, or extend endpoints.
Correlate JVM process behavior with inbound HTTP traffic to identify post-exploitation activity such as arbitrary code execution.

Monitoring Recommendations

Alert on any Coherence HTTP endpoint reachable from outside the trusted application tier.
Monitor Coherence cluster membership changes and configuration updates in near real time.
Forward WebLogic, Coherence, and host telemetry to a centralized analytics platform such as Singularity Data Lake for correlation and retention.

How to Mitigate CVE-2026-60259

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Coherence installations without delay.
Restrict network access to Coherence HTTP, cluster, and management ports to trusted application tiers only.
Audit exposed Fusion Middleware environments for Coherence endpoints reachable from the internet or user networks.
Review Coherence and WebLogic hosts for signs of prior compromise, including new users, scheduled tasks, and unexpected binaries.

Patch Information

Oracle released fixes for CVE-2026-60259 in the Oracle Critical Patch Update July 2026. Administrators should upgrade Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 to the patched versions specified in the advisory. Patch application requires downtime planning for clustered environments to preserve cache state.

Workarounds

Place Coherence management and REST endpoints behind an authenticating reverse proxy or VPN until patches are applied.
Enforce firewall rules that limit Coherence HTTP ports to specific application-server source IP addresses.
Disable Coherence HTTP acceptors that are not required for the deployment.

bash

# Example: restrict Coherence HTTP port with iptables to trusted app-tier subnet
iptables -A INPUT -p tcp --dport 8080 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP