CVE-2026-60268: Oracle Coherence Privilege Escalation

CVE-2026-60268 Overview

CVE-2026-60268 is a high-severity vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. Oracle disclosed the issue in the July 2026 Critical Patch Update. The flaw allows a low-privileged attacker with network access over TCP to compromise Oracle Coherence and take full control of the affected instance. The weakness is classified under improper access control [CWE-284] and impacts confidentiality, integrity, and availability. Affected supported versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Critical Impact
Successful exploitation results in full takeover of the Oracle Coherence instance, exposing distributed cache data and enabling attackers to disrupt or manipulate any application dependent on the cluster.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60268 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60268

Vulnerability Analysis

Oracle Coherence is a distributed in-memory data grid used to scale application state across clustered JVMs. The Core component handles cluster membership, service invocation, and cache operations over TCP. CVE-2026-60268 exposes an access control weakness in this layer, allowing an authenticated attacker with minimal privileges to escalate to full control of a Coherence node. Oracle rates the issue as easily exploitable, with no user interaction required. Once an attacker gains control of a Coherence member, they can read or modify cached objects, influence dependent applications, and pivot within the Fusion Middleware environment.

Root Cause

The underlying issue is an improper access control failure [CWE-284] in the Coherence Core. Operations exposed over the cluster's TCP transport are reachable by low-privileged principals that should not be authorized to invoke them. Because Coherence trusts cluster peers for management and data-plane operations, missing authorization checks translate directly into takeover primitives.

Attack Vector

Exploitation occurs over the network using the TCP protocol used by Coherence cluster and extend clients. The attacker must hold a low-privileged account or a foothold that can reach the Coherence listener. Oracle's advisory indicates the attack complexity is low, no user interaction is needed, and the scope is unchanged, with high impact to confidentiality, integrity, and availability. Refer to the Oracle Security Alert: July 2026 for authoritative technical context. No public proof-of-concept code has been released at the time of writing.

Detection Methods for CVE-2026-60268

Indicators of Compromise

Unexpected new members joining a Coherence cluster or Extend client connections originating from non-approved subnets or hosts.
Anomalous invocation service calls, EntryProcessor executions, or bulk cache mutations recorded in Coherence logs.
New or modified Java classes loaded by Coherence JVMs shortly after inbound TCP sessions from low-privileged accounts.

Detection Strategies

Enable and centralize Coherence audit and JVM logs, then alert on cluster join events, authentication failures, and invocation service usage by non-administrative principals.
Baseline TCP traffic to Coherence listener ports and flag deviations, particularly connections from application tiers that should not initiate cluster operations.
Correlate WebLogic and Fusion Middleware authentication events with subsequent Coherence activity to spot low-privilege accounts pivoting into the data grid.

Monitoring Recommendations

Monitor JVM process behavior on Coherence hosts for unexpected child processes, reflective class loading, or outbound connections.
Track file integrity for Coherence configuration files such as tangosol-coherence-override.xml and cache configuration descriptors.
Ingest Coherence and WebLogic logs into a SIEM or data lake and build detections for privilege changes and management operations invoked over the cluster port.

How to Mitigate CVE-2026-60268

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to every Coherence instance running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Inventory all Coherence clusters, including embedded deployments inside WebLogic domains and custom Java applications, to ensure no instance is missed.
Rotate credentials and review access for any low-privileged accounts that can reach Coherence TCP listeners.

Patch Information

Oracle published fixes as part of the Oracle Security Alert: July 2026. Administrators should follow the referenced patch matrix for each affected Coherence release and validate the patch level after installation. No workaround replaces applying the vendor patch.

Workarounds

Restrict network reachability to Coherence cluster and Extend proxy ports using firewalls, security groups, or Kubernetes network policies so that only trusted application tiers can connect.
Enforce Coherence Extend client authentication and enable TLS on cluster and proxy transports to prevent low-privileged principals from invoking cluster operations.
Run Coherence JVMs under a dedicated low-privilege OS account and apply a restrictive Java security policy to limit the blast radius of a compromised member.

bash

# Configuration example: restrict Coherence cluster port to trusted subnet
iptables -A INPUT -p tcp --dport 7574 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP