CVE-2026-60260 Overview
CVE-2026-60260 is an information disclosure vulnerability in Oracle Coherence, a component of Oracle Fusion Middleware. The flaw resides in the Core component and allows an unauthenticated attacker with network access via HTTP to read a subset of Oracle Coherence data. Oracle disclosed the issue in the July 2026 Critical Patch Update. Affected versions include Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability requires no privileges or user interaction and can be triggered remotely over HTTP.
Critical Impact
Unauthenticated remote attackers can obtain unauthorized read access to a subset of Oracle Coherence data through network-based HTTP requests.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60260 published to NVD as part of the Oracle July 2026 Critical Patch Update
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60260
Vulnerability Analysis
Oracle Coherence is a distributed in-memory data grid used to cache and manage application state across Oracle Fusion Middleware deployments. This vulnerability affects the Core component and exposes a subset of Coherence-accessible data to unauthenticated HTTP clients. The attack is network-based and easily exploitable, requiring no authentication or user interaction. Impact is limited to confidentiality; integrity and availability are unaffected. According to EPSS data dated 2026-07-23, the probability of observed exploitation is 0.316%. Oracle has not published detailed root-cause information beyond the July 2026 Critical Patch Update advisory.
Root Cause
Oracle's advisory categorizes the flaw as an information disclosure issue in the Core component of Oracle Coherence. The affected code path permits an unauthenticated HTTP request to return data that should require authenticated context. Oracle has not published a CWE mapping or granular root-cause details in the public advisory. The condition is present across four supported release lines, indicating a shared code path within Coherence's HTTP-facing services.
Attack Vector
An attacker sends crafted HTTP requests to a reachable Oracle Coherence instance. Because the vector is AV:N with PR:N and UI:N, exploitation requires only network reachability to the Coherence HTTP endpoint. Successful requests return a subset of data managed by the Coherence grid. Deployments that expose Coherence HTTP interfaces beyond a trusted network segment face the greatest exposure. See the Oracle CPU July 2026 Security Alert for advisory details.
Detection Methods for CVE-2026-60260
Indicators of Compromise
- Anomalous unauthenticated HTTP GET requests to Oracle Coherence management or data endpoints from external or unexpected internal sources.
- Spikes in HTTP response sizes from Coherence services correlated with requests lacking valid session or authentication headers.
- Access log entries showing repeated enumeration patterns against Coherence REST or management URIs.
Detection Strategies
- Inventory all Oracle Coherence deployments and identify versions matching 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
- Inspect HTTP access logs on Coherence and fronting reverse proxies for unauthenticated requests to Coherence resource paths.
- Deploy web application firewall (WAF) signatures that flag requests to Coherence endpoints originating from untrusted networks.
Monitoring Recommendations
- Enable verbose HTTP request logging on Coherence nodes and forward logs to a centralized SIEM for baseline and anomaly analysis.
- Alert on any external network flows reaching Coherence HTTP listener ports.
- Correlate authentication-free responses containing serialized Coherence data structures with source IP reputation feeds.
How to Mitigate CVE-2026-60260
Immediate Actions Required
- Apply the Oracle July 2026 Critical Patch Update to all Coherence installations running affected versions.
- Restrict network access to Coherence HTTP endpoints to trusted management subnets using firewall or security group rules.
- Audit exposed Coherence services with external attack surface scans to confirm no listener is reachable from the internet.
Patch Information
Oracle addressed CVE-2026-60260 in the July 2026 Critical Patch Update. Administrators should download and apply the fixes for Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 per the Oracle CPU July 2026 Security Alert. Test the patch in a staging environment before production rollout.
Workarounds
- Place Coherence HTTP listeners behind an authenticating reverse proxy that enforces mutual TLS or session-based authentication.
- Disable unused Coherence HTTP or REST management extensions until patching is complete.
- Segment Coherence clusters into isolated VLANs and permit access only from authorized Fusion Middleware application servers.
# Example firewall rule restricting Coherence HTTP port to a management subnet
iptables -A INPUT -p tcp --dport 9099 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
