CVE-2026-60265 Overview
CVE-2026-60265 affects the Core component of Oracle Coherence, an in-memory data grid within Oracle Fusion Middleware. The vulnerability permits a high-privileged attacker with local logon access to the infrastructure hosting Oracle Coherence to compromise the product. Successful exploitation grants unauthorized read access to critical data or complete access to all Oracle Coherence accessible data. The flaw involves a scope change, meaning exploitation may affect components beyond Oracle Coherence itself. The weakness is classified under [CWE-284] (Improper Access Control).
Critical Impact
Local attackers with elevated privileges can read all data accessible to Oracle Coherence, with potential impact extending to adjacent products due to scope change.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60265 published to the National Vulnerability Database (NVD)
- 2026-07-23 - Last updated in NVD database
- July 2026 - Addressed in the Oracle Critical Patch Update - July 2026
Technical Details for CVE-2026-60265
Vulnerability Analysis
The vulnerability resides in the Core component of Oracle Coherence, Oracle's distributed in-memory data grid used to cache and manage data across clustered application servers. The flaw is an improper access control issue [CWE-284] that allows a high-privileged local user to bypass intended restrictions and read data managed by Coherence.
Exploitation requires the attacker to already possess a valid high-privileged account on the host where Oracle Coherence runs. No user interaction is required. The attack complexity is low, meaning no special conditions must be met beyond the required privilege level.
The scope change indicates that the vulnerable Coherence component can affect resources beyond its own security authority. Applications and middleware that rely on Coherence for caching sensitive data, session state, or transactional records may be exposed as a result.
Root Cause
The root cause is improper enforcement of access control within the Coherence Core component. Authorization checks fail to prevent a privileged local principal from accessing data outside the intended trust boundary. Oracle has not released detailed technical specifics beyond the advisory.
Attack Vector
The attack vector is local. An attacker must log on to the infrastructure where Oracle Coherence executes and hold high privileges on that system. From this position, the attacker interacts with Coherence to retrieve confidential data. Integrity and availability are not impacted; only confidentiality is affected. See the Oracle Security Alert - July 2026 for the vendor-published details.
No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score at publication is 0.155%.
Detection Methods for CVE-2026-60265
Indicators of Compromise
- Unexpected authenticated sessions from privileged accounts on hosts running Oracle Coherence nodes.
- Anomalous Coherence management or JMX operations issued from local shells rather than orchestration tooling.
- Unusual volumes of cache read operations performed by administrative accounts.
Detection Strategies
- Compare the installed Oracle Coherence version against the affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) and flag unpatched instances.
- Enable auditing on Coherence cluster members and correlate local login events with subsequent Coherence process activity.
- Monitor for privileged process execution against Coherence JVMs, including debugger attachment, memory dumps, or unexpected JMX client connections.
Monitoring Recommendations
- Forward Coherence, WebLogic, and host operating system logs to a centralized analytics platform for correlation.
- Alert on new local administrator or Oracle service account logons to Coherence infrastructure outside change windows.
- Baseline expected Coherence client identities and alert on deviations, particularly from interactive sessions.
How to Mitigate CVE-2026-60265
Immediate Actions Required
- Apply the fixes from the Oracle Critical Patch Update released in July 2026 to all affected Coherence versions.
- Inventory every Oracle Coherence deployment, including embedded instances shipped with other Oracle Fusion Middleware products.
- Restrict interactive and remote logon rights on Coherence hosts to the minimum required administrative personnel.
Patch Information
Oracle addressed CVE-2026-60265 in the July 2026 Critical Patch Update. Administrators should download the applicable patch for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 directly from My Oracle Support and follow the deployment steps described in the Oracle Security Alert - July 2026.
Workarounds
- Remove unnecessary high-privileged local accounts from Coherence hosts and enforce just-in-time administrative access.
- Segment Coherence infrastructure on dedicated hosts to reduce the population of users who can log on locally.
- Enable host-based auditing and file integrity monitoring on Coherence installation directories until patching completes.
# Verify installed Oracle Coherence version prior to patching
cd $COHERENCE_HOME/bin
./version.sh
# List local users with logon rights to a Coherence host (Linux)
getent passwd | awk -F: '$7 !~ /(nologin|false)$/ {print $1}'
# Restrict interactive logon to a controlled admin group (example)
sudo usermod -aG coherence-admins <admin_user>
sudo sed -i 's/^#AllowGroups.*/AllowGroups coherence-admins/' /etc/ssh/sshd_config
sudo systemctl restart sshd
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
