CVE-2026-60266: Oracle Coherence Information Disclosure

CVE-2026-60266 Overview

CVE-2026-60266 is an information disclosure vulnerability in the Oracle Coherence product of Oracle Fusion Middleware. The flaw resides in the Core component and affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated remote attacker with network access via Transport Layer Security (TLS) can exploit the issue to obtain confidential data. Oracle addressed the vulnerability in the July 2026 Critical Patch Update. The weakness is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Successful exploitation can result in unauthorized access to critical Oracle Coherence data or complete read access to all data accessible by the Coherence process.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60266 published to the National Vulnerability Database (NVD)
July 2026 - Oracle publishes fixes in the Critical Patch Update
2026-07-23 - Last updated in the NVD database

Technical Details for CVE-2026-60266

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used to scale Oracle Fusion Middleware and Java-based applications. The Core component processes cluster and client communication, including channels secured with TLS. CVE-2026-60266 permits an unauthenticated network attacker to reach a code path that returns sensitive data over the TLS interface without proper authorization checks.

Exploitation is described by Oracle as difficult, requiring specific runtime conditions or timing to reach the vulnerable path. When those conditions are met, the attacker gains read access to data managed by Coherence. Integrity and availability are not affected, matching the confidentiality-only impact profile of [CWE-200]. The EPSS probability is 0.318% with a percentile of 24.055, indicating limited near-term exploitation likelihood at the time of publication.

Root Cause

The root cause is insufficient access control on data returned through the Coherence Core communication layer. Sensitive cluster or cache data is exposed to a caller that has not authenticated, provided the attacker can complete the required TLS handshake and reach the vulnerable endpoint. Oracle has not released source-level detail beyond the advisory.

Attack Vector

The attack vector is network-based over TLS. The attacker requires no privileges and no user interaction. Any Coherence cluster port exposed to untrusted networks is a potential entry point, including through misconfigured perimeter controls or east-west traffic in shared infrastructure. See the Oracle Security Alert July 2026 for authoritative technical context.

No verified proof-of-concept code is publicly available for CVE-2026-60266.
Refer to the Oracle July 2026 Critical Patch Update advisory for technical details.

Detection Methods for CVE-2026-60266

Indicators of Compromise

Unexpected TLS connections to Coherence cluster ports (default 9000, 7574, and Extend proxy ports) originating from untrusted networks or unknown hosts.
Anomalous volumes of read or query traffic against Coherence Extend/gRPC endpoints outside baseline application patterns.
Coherence process logs showing repeated session establishment without corresponding authenticated operations.

Detection Strategies

Inventory all Oracle Coherence deployments and confirm build numbers against Oracle's July 2026 CPU fix matrix.
Enable and centralize Coherence audit and access logs, correlating source IP, TLS session ID, and requested cache or service.
Baseline normal client identities and alert on connections from IP ranges or JVMs that have never previously accessed the cluster.

Monitoring Recommendations

Forward Coherence, Fusion Middleware, and TLS termination logs to a security data lake for retention and correlation.
Monitor network flows to Coherence ports for connections that bypass application tiers and reach the grid directly.
Track new or unsigned client certificates negotiating TLS with Coherence nodes.

How to Mitigate CVE-2026-60266

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Coherence versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0).
Restrict network reachability of Coherence cluster and Extend proxy ports to application tiers only.
Rotate any credentials, tokens, or keys that could have been stored in exposed caches if compromise is suspected.

Patch Information

Oracle released fixes for CVE-2026-60266 in the July 2026 Critical Patch Update. Patch downloads, version-specific bundle identifiers, and prerequisite information are documented in the Oracle Security Alert July 2026. Administrators should validate that Fusion Middleware components dependent on Coherence are recycled after patching to load the corrected libraries.

Workarounds

Enforce mutual TLS (mTLS) with strict client certificate validation on all Coherence Extend and cluster endpoints.
Place Coherence clusters behind segmented networks or private subnets and deny direct client access from user or internet-facing zones.
Disable unused Coherence services (Extend proxy, gRPC, management endpoints) on nodes that do not require them.

bash

# Example: restrict Coherence Extend proxy port to application subnet only
iptables -A INPUT -p tcp --dport 9099 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP

# Verify Coherence patch level after applying July 2026 CPU
java -cp coherence.jar com.tangosol.net.CacheFactory -version