CVE-2026-60269: Oracle Coherence RCE Vulnerability

CVE-2026-60269 Overview

CVE-2026-60269 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via TCP can compromise Oracle Coherence and achieve full product takeover. Oracle disclosed the flaw in the Oracle Security Alert July 2026. The vulnerability affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Successful exploitation impacts confidentiality, integrity, and availability of the affected system.

Critical Impact
An unauthenticated remote attacker can take over Oracle Coherence over TCP, gaining full control of the in-memory data grid and any data it holds.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - Oracle published the vulnerability in the July 2026 Critical Patch Update
2026-07-21 - CVE-2026-60269 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60269

Vulnerability Analysis

Oracle Coherence is a distributed, in-memory data grid used by enterprise applications for caching, session management, and low-latency data access. The Core component exposes cluster communication services over TCP. The vulnerability allows an unauthenticated attacker with network reachability to the Coherence TCP listener to compromise the product without user interaction. The scope is unchanged, but confidentiality, integrity, and availability impacts are all high, indicating full product takeover.

Oracle rates this as easily exploitable, meaning no special conditions or authentication are required. Because Coherence typically stores application state, session data, and cached business objects, a compromise exposes that data and provides a foothold inside the middleware tier.

Root Cause

Oracle did not publish detailed root-cause information in the advisory. Historically, Coherence takeover flaws have stemmed from unsafe deserialization of untrusted objects received on the cluster TCP port (tangosol.coherence.wka / Coherence Extend or TCMP protocols). The advisory attributes the issue to the Core component, which handles cluster membership and message dispatch.

Attack Vector

Exploitation requires only network access to a Coherence TCP port. An attacker sends a crafted payload to the exposed listener, triggering the flaw in the Core component and gaining control of the Coherence process. From that position, an attacker can read cached data, tamper with cluster state, or pivot to the underlying host with the privileges of the Coherence JVM. No credentials, no user interaction, and no prior foothold are required. Verified proof-of-concept code is not currently available in public exploit databases; the EPSS score is 0.358%.

Detection Methods for CVE-2026-60269

Indicators of Compromise

Unexpected inbound TCP connections to Coherence cluster ports (default 7574 for cluster discovery, plus dynamically assigned unicast ports) from untrusted networks.
Coherence JVM spawning unusual child processes such as shells, curl, wget, or scripting interpreters.
New or modified files in the Coherence installation directory, Fusion Middleware home, or /tmp immediately after inbound traffic to cluster ports.
Outbound connections from the Coherence host to unfamiliar external addresses following cluster port activity.

Detection Strategies

Alert on any process descended from the Coherence Java process (java with Coherence classpath) that is not part of the normal application stack.
Monitor for anomalous serialization or ClassLoader activity in Coherence logs and JVM diagnostic output.
Use network detection rules to flag traffic to Coherence TCP ports originating from outside the trusted middleware segment.

Monitoring Recommendations

Forward Coherence and WebLogic logs to a centralized SIEM and baseline normal cluster join and message patterns.
Enable JVM audit logging and capture command-line arguments for all processes spawned on middleware hosts.
Continuously verify that Coherence cluster ports are not exposed to the internet or untrusted internal zones.

How to Mitigate CVE-2026-60269

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle Coherence instances running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Restrict TCP access to Coherence cluster and Extend ports so that only trusted application servers can reach them.
Inventory all Coherence deployments, including embedded uses inside WebLogic and custom applications, before patching.
Rotate credentials and secrets cached in Coherence if exposure is suspected.

Patch Information

Oracle addressed CVE-2026-60269 in the July 2026 Critical Patch Update. Refer to the Oracle Security Alert July 2026 for patch identifiers and version-specific instructions covering Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Apply the patch in staging first, validate cluster behavior, then roll out to production.

Workarounds

Place Coherence cluster nodes on an isolated network segment reachable only by authorized application servers.
Enforce host-based firewall rules that permit Coherence TCP ports only from known peer IP addresses.
Enable Coherence Security Framework features such as identity assertion and TLS on cluster and Extend endpoints where supported.
Disable or remove Coherence Extend proxies that are not required by the application.

bash

# Example iptables rules restricting Coherence cluster traffic to trusted peers
iptables -A INPUT -p tcp --dport 7574 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
iptables -A INPUT -p tcp --dport 9099 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP