CVE-2026-60263: Oracle Coherence Information Disclosure

CVE-2026-60263 Overview

CVE-2026-60263 is a missing authentication vulnerability [CWE-306] in the Core component of Oracle Coherence, a distributed caching and in-memory data grid product within Oracle Fusion Middleware. An unauthenticated attacker with network access via TCP can exploit this weakness to gain unauthorized access to critical data or complete access to all data accessible through Oracle Coherence. The vulnerability affects Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle addressed the flaw in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can read all data stored in and served by Oracle Coherence instances exposed to reachable networks.

Affected Products

Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60263 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60263

Vulnerability Analysis

Oracle Coherence is a distributed in-memory data grid used to cluster application state across JVM nodes. The Core component exposes cluster and cache services over TCP for client and node-to-node communication. CVE-2026-60263 stems from missing authentication on network-reachable service endpoints, allowing any attacker who can open a TCP connection to interact with Coherence services without presenting valid credentials.

Exploitation is classified as low complexity and requires no user interaction. The impact is limited to confidentiality: an attacker can read cached objects, cluster metadata, and any data structures the compromised node manages. Integrity and availability are not directly affected by this specific flaw, but the exposed data often includes session state, business objects, and secrets that support attacks against upstream systems.

Root Cause

The root cause is Missing Authentication for a Critical Function [CWE-306]. Coherence's TCP-based communication paths accept requests from any peer that can complete the protocol handshake, without enforcing an authentication check on the requester. When deployments do not enable Coherence's optional identity and TLS features, the service treats network reachability as implicit trust.

Attack Vector

The attack vector is network-based. An attacker sends crafted TCP requests to a Coherence listener port, joins or queries the cluster as if it were a legitimate client, and retrieves data from named caches. Since authentication is absent, no credential brute force or session theft is required. Any host with reachability to the Coherence TCP ports — including flat internal networks, misconfigured cloud security groups, or exposed management interfaces — is in scope.

No public proof-of-concept exploit code is available at time of publication. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-60263

Indicators of Compromise

Unexpected TCP connections to Coherence cluster ports (default 7574 for cluster discovery and dynamically assigned Extend proxy ports) from hosts outside the documented cluster membership.
New or unauthorized nodes joining the Coherence cluster, visible in Coherence management logs and JMX metrics.
Anomalous cache read volume or bulk enumeration patterns against named caches during off-hours.

Detection Strategies

Inventory all Oracle Coherence deployments and compare running versions against 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Baseline expected cluster membership and alert on MemberJoined and MemberLeft events in Coherence logs that do not correlate with change tickets.
Inspect network flow logs for TCP traffic to Coherence ports originating from non-application-tier subnets.

Monitoring Recommendations

Forward Coherence, WebLogic, and host logs to a centralized SIEM and build alerts on cluster membership changes and Extend client connections.
Enable JMX and MBean auditing to capture cache query patterns that indicate bulk data enumeration.
Monitor egress from Coherence hosts for outbound transfers that could indicate data staging after unauthorized read access.

How to Mitigate CVE-2026-60263

Immediate Actions Required

Apply the fixes from the July 2026 Oracle Critical Patch Update to all Oracle Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 installations.
Restrict TCP access to Coherence cluster and Extend proxy ports to the application tier only using host firewalls, security groups, or network ACLs.
Audit existing clusters for unauthorized member nodes and rotate any secrets that may have been cached in Coherence.

Patch Information

Oracle released fixes for CVE-2026-60263 as part of the Critical Patch Update in July 2026. Details, affected versions, and download links are available in the Oracle Security Alert July 2026. Apply the patch corresponding to the exact Coherence release running in each environment and validate cluster health after deployment.

Workarounds

Enable Coherence identity and access controls, including cluster member authentication and TLS for cluster and Extend traffic, to require authenticated peers.
Place Coherence clusters on isolated network segments and block Coherence TCP ports at perimeter and inter-segment firewalls.
Disable Coherence*Extend proxies where they are not required, and bind listeners to internal interfaces rather than all interfaces.

bash

# Example: restrict Coherence cluster port 7574 to application subnet only
iptables -A INPUT -p tcp --dport 7574 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP