CVE-2026-60271: Oracle Coherence Privilege Escalation

CVE-2026-60271 Overview

CVE-2026-60271 affects the Core component of Oracle Coherence within Oracle Fusion Middleware. The flaw allows a low-privileged attacker with local logon access to the infrastructure running Oracle Coherence to fully compromise the product. Oracle disclosed the issue in the July 2026 Critical Patch Update. Affected supported releases include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Successful exploitation results in a complete takeover of Oracle Coherence, impacting confidentiality, integrity, and availability of the in-memory data grid.

Critical Impact
A local, authenticated attacker with minimal privileges can take over Oracle Coherence, exposing cached enterprise data and clustered application state.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0 and 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60271 published to the National Vulnerability Database (NVD)
2026-07-21 - Oracle publishes the July 2026 Critical Patch Update advisory
2026-07-23 - NVD record last modified

Technical Details for CVE-2026-60271

Vulnerability Analysis

Oracle Coherence is a distributed in-memory data grid used by Fusion Middleware applications for caching, clustering, and stateful workload distribution. The vulnerability resides in the Core component and is reachable by any account with interactive or service-level logon to the host executing Coherence. Because the attack vector is local and the required privileges are low, standard application users, batch service accounts, or compromised low-tier processes on the same host can trigger the flaw. A successful attack yields complete confidentiality, integrity, and availability compromise of the Coherence instance, meaning attackers can read cached data, alter cluster state, and disrupt dependent Fusion Middleware services.

Root Cause

Oracle has not published root-cause internals for CVE-2026-60271. The advisory characterizes the issue as an easily exploitable local vulnerability in the Core component that permits scope-unchanged privilege takeover of the Coherence process. Refer to the Oracle Critical Patch Update July 2026 for the authoritative technical description.

Attack Vector

Exploitation requires local logon to the infrastructure that runs Oracle Coherence and a low-privileged account. No user interaction is needed and attack complexity is low. An attacker leverages their existing session on the host to interact with Coherence process resources, files, or IPC surfaces exposed by the Core component. The result is takeover of the Coherence runtime under the identity of the service, giving the attacker the same access as the Coherence process itself.

No public proof-of-concept, exploit code, or CISA KEV listing exists for CVE-2026-60271 at the time of publication. The EPSS probability is 0.151%, reflecting a low observed likelihood of exploitation activity in the short term.

Detection Methods for CVE-2026-60271

Indicators of Compromise

Unexpected child processes, shells, or scripts spawned by the Coherence JVM (java process running com.tangosol.* classes).
Anomalous local file access to Coherence configuration, cache stores, or coherence.jar directories by non-service accounts.
New or modified Coherence cluster members joining outside the approved change window.
Elevation of a low-privileged local account into the Coherence service identity.

Detection Strategies

Baseline the process tree of Oracle Coherence nodes and alert on deviations, especially interactive child processes.
Correlate local logons on Coherence hosts with subsequent access to Coherence binaries, configuration files, and TCMP ports.
Enable Java Flight Recorder or JVM auditing on Coherence nodes to capture unexpected reflective or deserialization activity in the Core component.

Monitoring Recommendations

Forward host, authentication, and JVM logs from Coherence servers into a centralized analytics platform for correlation.
Track membership changes and management operations against Coherence clusters via MBean and JMX audit trails.
Alert on privilege changes affecting the Coherence service account or files under the Coherence installation path.

How to Mitigate CVE-2026-60271

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to every Oracle Coherence deployment on supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Inventory all Fusion Middleware hosts that embed Coherence, including WebLogic-managed servers, and confirm patch coverage.
Restrict interactive and service logons on Coherence hosts to a minimal set of administrators and hardened service accounts.
Rotate credentials for any accounts with prior local access to Coherence infrastructure that cannot be verified as trusted.

Patch Information

Oracle addressed CVE-2026-60271 in the Oracle Critical Patch Update July 2026. Administrators should follow the CPU advisory to identify the specific patch bundle for each affected Coherence release and apply it through Oracle's standard OPatch process. No vendor-approved workaround supersedes applying the patch.

Workarounds

Enforce least-privilege on Coherence hosts and remove shell or SSH access for non-administrative users until patching is complete.
Segment Coherence infrastructure onto dedicated hosts or containers to limit which workloads share the local attack surface.
Apply host-based access controls (SELinux, AppArmor, or Windows ACLs) to protect the Coherence installation directory and runtime files.
Monitor Coherence service accounts for privilege changes and disable unused local accounts on affected servers.

bash

# Verify Oracle Coherence version on a host before and after patching
$ORACLE_HOME/oui/bin/opatch lspatches
java -cp $COHERENCE_HOME/lib/coherence.jar com.tangosol.net.CacheFactory -version