CVE-2026-60262 Overview
CVE-2026-60262 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated remote attacker with network access via TCP can compromise Oracle Coherence without user interaction. Successful exploitation results in complete takeover of the Oracle Coherence instance, affecting confidentiality, integrity, and availability. The flaw is classified under [CWE-306] Missing Authentication for Critical Function. Oracle disclosed the vulnerability in the July 2026 Critical Patch Update.
Critical Impact
An unauthenticated attacker on the network can achieve full takeover of Oracle Coherence, exposing cached data, application state, and clustered service infrastructure.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60262 published to the National Vulnerability Database (NVD)
- 2026-07-23 - Last updated in the NVD database
Technical Details for CVE-2026-60262
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used to scale Java applications through distributed caching and clustered services. The vulnerability resides in the Core component and allows an attacker to interact with Coherence over TCP without authenticating. Because Coherence cluster members handle serialized objects and remote invocations, missing authentication on a critical function exposes the entire runtime to hostile input.
An attacker reaching a listening Coherence port can invoke functionality reserved for trusted cluster members. The result is complete compromise of the Coherence process, including access to cached data and the ability to execute operations under the privileges of the Coherence service account. The attack requires no privileges and no user interaction, and it can be launched across the network.
Root Cause
The root cause is a Missing Authentication for Critical Function weakness [CWE-306]. A critical Coherence code path fails to verify the identity of the caller before performing sensitive operations. This design flaw treats any TCP peer that speaks the expected protocol as an authorized participant.
Attack Vector
Exploitation occurs over the network via TCP against an exposed Coherence port. The attacker connects to the service, issues protocol-level messages targeting the unauthenticated function, and gains control over the Coherence node. In deployments where Coherence ports are reachable from application tiers, DMZs, or the internet, exploitation is direct. Refer to the Oracle Security Alert - July 2026 for vendor-specific technical detail.
No verified public exploit code is available at the time of writing.
See the Oracle Critical Patch Update advisory for authoritative technical details.
Detection Methods for CVE-2026-60262
Indicators of Compromise
- Unexpected inbound TCP connections to Coherence cluster ports from hosts outside the defined cluster membership.
- Spawning of child processes such as shells, java sub-invocations, or scripting interpreters from the Coherence JVM.
- New or modified files in Coherence working directories, or unexplained outbound network callbacks from Coherence hosts.
- Coherence log entries showing deserialization events, remote invocations, or cluster joins from unknown addresses.
Detection Strategies
- Baseline the set of hosts and ports that legitimately participate in each Coherence cluster and alert on deviations.
- Inspect Coherence and WebLogic logs for anomalous remote invocations, class loading errors, or authentication warnings.
- Correlate JVM process telemetry with network telemetry to catch code execution originating from Coherence nodes.
Monitoring Recommendations
- Monitor egress traffic from Coherence hosts to detect command-and-control beacons following exploitation.
- Enable and centralize Coherence audit and cluster membership logs in a SIEM for retention and correlation.
- Track file integrity on Coherence installation directories, configuration files, and cache stores.
How to Mitigate CVE-2026-60262
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all affected Coherence versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0).
- Inventory all Coherence deployments, including embedded uses within Oracle Fusion Middleware and WebLogic Server.
- Restrict Coherence cluster ports to trusted internal segments and block them at perimeter and internal firewalls.
- Review recent logs and network flows for signs of prior exploitation before completing patching.
Patch Information
Oracle addressed CVE-2026-60262 in the July 2026 Critical Patch Update. Patches are available for the supported affected versions listed above. Consult the Oracle Security Alert - July 2026 for exact patch identifiers, prerequisites, and installation guidance.
Workarounds
- Isolate Coherence traffic on a dedicated network segment reachable only by authorized cluster members and application servers.
- Enforce TLS and Coherence access controllers using Oracle-documented SSLSocketProvider and identity assertion configurations.
- Disable or firewall any Coherence Extend proxy listeners that do not require external exposure until patches are applied.
# Example: restrict Coherence cluster port exposure with iptables
# Replace 7574 and 9099 with the ports used by your deployment
iptables -A INPUT -p tcp --dport 7574 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
iptables -A INPUT -p tcp --dport 9099 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
