CVE-2026-60270 Overview
CVE-2026-60270 is an access control vulnerability [CWE-284] in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A high-privileged attacker with network access over HTTP can exploit the weakness to compromise the Coherence data grid. Successful exploitation grants unauthorized read access to all Coherence-accessible data and unauthorized update, insert, or delete access to a subset of that data. Oracle addressed the issue in the July 2026 Critical Patch Update.
Critical Impact
Authenticated attackers reaching Oracle Coherence over HTTP can read all accessible data and modify a subset of it, undermining confidentiality and integrity of cached application state.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60270 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60270
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used by enterprise applications for distributed caching and stateful computation. The Core component processes cluster management and data access requests. This vulnerability arises from improper access control enforcement within that component when handling requests received over HTTP. Attackers who already hold high privileges on the target instance can invoke functionality that should remain restricted, extending their reach across the cached dataset. The issue is tracked as [CWE-284: Improper Access Control].
The EPSS model estimates a low probability of near-term exploitation. No public proof-of-concept has been observed, and CISA has not added the CVE to the Known Exploited Vulnerabilities catalog.
Root Cause
The Core component fails to fully enforce authorization boundaries on privileged operations. Once authenticated with elevated rights, an attacker can access data or perform write operations beyond the scope intended for that role, effectively bypassing intra-tenant separation within Coherence-accessible data.
Attack Vector
Exploitation requires network reachability to the Coherence management or data endpoints over HTTP, along with a high-privilege account. The attack requires no user interaction and no additional complexity. See the Oracle Security Alert July 2026 for vendor-supplied details.
No verified exploit code is publicly available. The vulnerability is described in prose based on the Oracle advisory and NVD entry; no synthetic exploitation code is provided.
Detection Methods for CVE-2026-60270
Indicators of Compromise
- Unexpected HTTP requests to Oracle Coherence management or REST endpoints originating from administrative or service accounts outside their normal operational windows.
- Bulk read operations against Coherence caches followed by write, insert, or delete activity that deviates from baseline application behavior.
- Authentication events for high-privilege Coherence accounts from workstations or hosts not previously associated with those identities.
Detection Strategies
- Enable Coherence audit logging and forward authentication and cache-access events to a centralized analytics platform for correlation.
- Baseline normal cache access patterns per service account and alert on statistical deviations in request volume, cache scope, or operation mix.
- Correlate HTTP access logs from front-end load balancers with Coherence cluster logs to identify direct data-plane requests bypassing application tiers.
Monitoring Recommendations
- Monitor privileged Coherence role usage and flag any interactive session originating from non-approved networks.
- Track write operations (put, remove, invoke) against caches that are normally read-only from a given account.
- Alert on configuration changes to Coherence security policies, role mappings, or HTTP listener bindings.
How to Mitigate CVE-2026-60270
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update fixes for Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
- Inventory all Coherence deployments and identify instances exposing HTTP management or REST endpoints outside trusted network segments.
- Rotate credentials for high-privilege Coherence accounts and review recent audit logs for anomalous administrative activity.
Patch Information
Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should follow the update guidance in the Oracle Security Alert July 2026 and apply the patches to every affected Coherence version in production, staging, and disaster-recovery environments.
Workarounds
- Restrict network access to Coherence HTTP endpoints using firewall rules or service-mesh policies so only application tiers can reach them.
- Enforce least-privilege role assignments and remove standing high-privilege access for automation accounts that do not require it.
- Require mutual TLS or a reverse proxy with strong authentication in front of Coherence management interfaces until patching is complete.
# Example: restrict Coherence HTTP management port to application subnet only
iptables -A INPUT -p tcp --dport 8080 -s 10.20.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
