CVE-2026-60267: Oracle Coherence Auth Bypass Vulnerability

CVE-2026-60267 Overview

CVE-2026-60267 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via TLS can compromise Oracle Coherence without user interaction. Successful exploitation leads to unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Oracle Coherence accessible data. Oracle addressed this issue in the July 2026 Critical Patch Update. The vulnerability is categorized under [CWE-284] Improper Access Control.

Critical Impact
Unauthenticated network attackers can read and modify all data accessible to Oracle Coherence deployments running affected versions.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0, 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60267 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60267

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used to cache and share data across distributed Java applications. The flaw resides in the Core component and enables an attacker with only network access over TLS to compromise the service. No authentication, credentials, or user interaction are required to exploit the issue.

Exploitation results in high impact to confidentiality and integrity. An attacker can read, create, delete, or modify data that Oracle Coherence can access. Availability of the service itself is not directly impacted according to the vendor scoring. Because Coherence commonly stores session data, financial records, and cached application state, downstream applications relying on its data are also at risk.

Root Cause

The root cause is improper access control [CWE-284] within the Coherence Core component. Oracle has not published detailed technical internals for the flaw. The July 2026 Oracle Critical Patch Update documents the affected versions and provides fixed releases.

Attack Vector

The attack vector is remote and reaches the Coherence service over its TLS-enabled network interface. Attack complexity is low, and no privileges or user interaction are needed. Public exploit code is not currently available, and the EPSS probability sits at 0.398%. Refer to the Oracle CPU July 2026 Security Alert for vendor-supplied technical guidance.

Detection Methods for CVE-2026-60267

Indicators of Compromise

Unexpected connections to Oracle Coherence cluster ports (default 7574, 9099, and configured Extend/TLS ports) from untrusted source addresses.
Anomalous cache mutation events such as bulk put, remove, or invoke operations against Coherence caches without a preceding application session.
Coherence server log entries showing member joins or Extend client connections from unmanaged hosts.

Detection Strategies

Enable Coherence audit and access logging, then forward events to a SIEM for correlation against approved cluster members and application clients.
Monitor for TLS handshakes to Coherence ports originating from outside the application tier network segment.
Baseline normal cache operation volumes and alert on statistical deviations that suggest mass data read or modification.

Monitoring Recommendations

Ingest Coherence, WebLogic, and host operating system logs into a centralized analytics platform with retention sufficient for incident review.
Track outbound egress from Coherence hosts to detect data exfiltration following compromise.
Alert on privilege changes or configuration edits to tangosol-coherence-override.xml and TLS keystore files.

How to Mitigate CVE-2026-60267

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Coherence installations running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Inventory every Coherence cluster, including embedded deployments inside WebLogic and custom Java applications, before patching.
Restrict network access to Coherence cluster and Extend proxy ports to trusted application hosts only.

Patch Information

Oracle released fixed versions as part of the July 2026 Critical Patch Update. Administrators should download the corresponding patch for each affected release from My Oracle Support and follow the deployment steps in the Oracle CPU July 2026 Security Alert.

Workarounds

Place Coherence clusters behind a firewall or private subnet and block all direct external access to cluster ports.
Require mutual TLS authentication for Extend clients and cluster members, and rotate any keys or certificates suspected of exposure.
Disable unused Coherence Extend proxies and management endpoints until patches are applied.

bash

# Example iptables rule restricting Coherence Extend port to application subnet
iptables -A INPUT -p tcp --dport 9099 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP