CVE-2026-60264: Oracle Coherence RCE Vulnerability

CVE-2026-60264 Overview

CVE-2026-60264 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated remote attacker can exploit the flaw over HTTP/2 with low complexity and no user interaction. Successful exploitation results in full takeover of the Oracle Coherence instance, compromising confidentiality, integrity, and availability. Oracle disclosed the issue in the Oracle Security Alert July 2026. The Common Weakness Enumeration classification is [CWE-200] Information Exposure, though the reported impact extends to complete system compromise.

Critical Impact
An unauthenticated network attacker can take over Oracle Coherence instances by sending crafted HTTP/2 traffic, gaining full control of the affected middleware.

Affected Products

Oracle Coherence version 14.1.1.0.0
Oracle Coherence version 14.1.2.0.0
Oracle Coherence version 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE CVE-2026-60264 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60264

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used to scale distributed applications across Oracle Fusion Middleware deployments. The flaw resides in the Core component and is reachable over HTTP/2. An attacker with only network access can trigger the vulnerability without credentials or user interaction. Successful exploitation grants complete takeover of the Coherence process, which typically runs with privileged access to cached application data and cluster coordination services. Because Coherence instances often participate in service meshes and back critical WebLogic and application tiers, a compromise pivots directly into adjacent enterprise systems. The vulnerability is mapped to [CWE-200], but the reported impact scope reaches full confidentiality, integrity, and availability compromise. The EPSS probability is 0.358% at the 28.264 percentile as of 2026-07-23.

Root Cause

Oracle has not published the specific root cause in public advisories. The [CWE-200] mapping indicates that information exposure is part of the fault chain, and the HTTP/2 attack surface points to weaknesses in request handling within the Coherence Core component. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical context.

Attack Vector

The attack vector is remote network access to the HTTP/2 listener exposed by Oracle Coherence. An unauthenticated attacker delivers crafted HTTP/2 requests to the exposed endpoint. No prior credentials, session, or user action are required. Environments that publish Coherence management or extend endpoints beyond trusted network segments are directly exposed.

No verified public proof-of-concept code is available at time of writing. Administrators should treat the flaw as remotely weaponizable given the low attack complexity described by Oracle.

Detection Methods for CVE-2026-60264

Indicators of Compromise

Unexpected HTTP/2 connections to Oracle Coherence listener ports from untrusted networks or unusual source addresses.
New or unexpected child processes spawned by the Coherence Java virtual machine, including shells or scripting interpreters.
Outbound network connections from Coherence hosts to unknown external endpoints, indicating post-exploitation command and control.
Modifications to Coherence configuration files, cache stores, or cluster membership without a corresponding change ticket.

Detection Strategies

Inspect HTTP/2 traffic to Coherence endpoints for malformed frames, oversized headers, or protocol anomalies using a network intrusion detection system.
Correlate authentication events, JVM process telemetry, and outbound network flows on Coherence hosts to identify chained post-exploitation activity.
Baseline normal Coherence cluster behavior and alert on deviations such as unexpected node joins, cache invalidations, or administrative RPCs.

Monitoring Recommendations

Enable verbose logging on Coherence management endpoints and forward logs to a centralized analytics platform for retention and search.
Monitor CPU, memory, and network utilization on Coherence nodes to detect resource abuse tied to exploitation attempts.
Alert on any inbound HTTP/2 connection to Coherence ports that originates outside the approved management network.

How to Mitigate CVE-2026-60264

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 deployments without delay.
Restrict network access to Coherence HTTP/2 listeners so that only trusted management hosts can reach them.
Audit Coherence hosts for signs of prior compromise, focusing on process ancestry, outbound connections, and configuration changes.

Patch Information

Oracle addresses CVE-2026-60264 in the July 2026 Critical Patch Update. Review the Oracle Security Alert July 2026 for patch identifiers, download instructions, and version-specific guidance. Apply the fix on all affected 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 installations.

Workarounds

Place Coherence HTTP/2 endpoints behind a reverse proxy or firewall that enforces mutual TLS and IP allow-listing.
Disable HTTP/2 on Coherence listeners where operationally feasible until the vendor patch is applied.
Segment Coherence clusters into dedicated network zones that are unreachable from user, internet, or partner networks.

bash

# Example firewall restriction limiting Coherence HTTP/2 access to a management subnet
iptables -A INPUT -p tcp --dport 9099 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP