CVE-2026-60261 Overview
CVE-2026-60261 is a high-severity vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with access to the physical communication segment attached to the hardware running Oracle Coherence can compromise the product. Successful exploitation results in full takeover of Oracle Coherence, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the Oracle July 2026 Security Alert.
Critical Impact
An adjacent-network attacker without credentials or user interaction can take over Oracle Coherence instances running affected versions.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60261 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60261
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used for distributed caching and application scaling across Oracle Fusion Middleware deployments. The vulnerability resides in the Core component and is reachable across the adjacent network segment attached to the host running Coherence. Oracle classifies the flaw as easily exploitable, requiring neither authentication nor user interaction.
Exploitation compromises confidentiality, integrity, and availability, culminating in full takeover of the Coherence process. Because Coherence typically executes with elevated privileges to manage cluster membership, in-memory data, and inter-node communication, an attacker gains a foothold to pivot into cluster peers and dependent Fusion Middleware services.
The adjacent-network requirement means the attacker must reach the same broadcast domain, VLAN, or cluster subnet where Coherence nodes communicate. Coherence clusters commonly rely on unicast or multicast traffic on isolated segments, which becomes the primary exposure surface.
Root Cause
Oracle has not released a public technical breakdown. The vendor advisory attributes the issue to the Core component of Coherence and confirms the attack path travels through the cluster communication layer. Refer to the Oracle July 2026 Security Alert for authoritative details.
Attack Vector
The attack vector is Adjacent Network. An attacker positioned on the same physical or logical network segment as a Coherence node can send crafted traffic to the cluster communication ports. No credentials are required, and the attack complexity is low. The result is remote takeover of the Coherence instance and its data.
No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.272%.
Detection Methods for CVE-2026-60261
Indicators of Compromise
- Unexpected Coherence cluster join events or new member IDs originating from unauthorized hosts on the cluster subnet.
- Anomalous outbound traffic from Coherence JVM processes to non-cluster destinations following a suspicious cluster event.
- Java process spawning shell interpreters or writing to unusual paths on Coherence hosts.
Detection Strategies
- Monitor Coherence cluster membership logs (Coherence.log) for unauthorized MemberJoined or MemberLeft events outside change windows.
- Alert on new listeners or child processes spawned by the Coherence JVM using endpoint telemetry.
- Inspect network flows on cluster VLANs for traffic sources that are not part of the approved node inventory.
Monitoring Recommendations
- Enable verbose Coherence logging and forward logs to a centralized SIEM for correlation with network telemetry.
- Baseline cluster membership and inter-node traffic volume, then alert on deviations.
- Track patch state and version strings (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) across all Fusion Middleware inventories.
How to Mitigate CVE-2026-60261
Immediate Actions Required
- Apply the Oracle July 2026 Critical Patch Update to all affected Coherence installations.
- Inventory all Fusion Middleware deployments to confirm which Coherence versions are in use.
- Restrict access to Coherence cluster network segments to trusted, authenticated hosts only.
Patch Information
Oracle addresses CVE-2026-60261 in the Oracle July 2026 Security Alert. Administrators should download and apply the corresponding Critical Patch Update for each affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) following Oracle's documented upgrade procedure.
Workarounds
- Isolate Coherence cluster traffic on dedicated VLANs with strict ingress and egress filtering.
- Enforce network segmentation so only authorized application servers can reach Coherence Well Known Addresses (WKA) and cluster ports.
- Enable Coherence Secure Sockets Layer (SSL) and cluster authentication features to reduce exposure until patching completes.
# Configuration example: restrict Coherence cluster ports to trusted subnet using iptables
iptables -A INPUT -p tcp --dport 7574 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 7574 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
iptables -A INPUT -p udp --dport 7574 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
