CVE-2026-60272: Oracle Coherence RCE Vulnerability

CVE-2026-60272 Overview

CVE-2026-60272 is a network-exploitable vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with HTTP access can compromise the product and achieve a full takeover of the Coherence instance. Oracle disclosed the issue in the Oracle Security Alert July 2026.

Affected supported versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability requires no user interaction and no privileges, making it viable for opportunistic mass exploitation once technical details become public.

Critical Impact
Unauthenticated network attackers can achieve complete takeover of Oracle Coherence, resulting in high impact to confidentiality, integrity, and availability.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - Oracle publishes the July 2026 Critical Patch Update advisory
2026-07-21 - CVE-2026-60272 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60272

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used for distributed caching, session management, and stateful microservice coordination inside Oracle Fusion Middleware deployments. The advisory classifies the flaw as easily exploitable over HTTP by an unauthenticated remote attacker, with the outcome described as a complete takeover of the Coherence instance.

Because the attack traverses the network without authentication or user interaction, an adversary who can reach a Coherence HTTP listener can drive the exploit to completion in a single request chain. Successful exploitation grants the attacker control over cached application state and any credentials or tokens held in the grid.

Oracle has not published a component-level breakdown of the flaw beyond identifying the Core component. Refer to the Oracle Security Alert July 2026 for authoritative technical details.

Root Cause

The advisory attributes the vulnerability to the Core component of Oracle Coherence across four supported release lines. Historically, remote takeover vulnerabilities in Coherence have stemmed from insecure deserialization of attacker-controlled data reaching internal cluster or management endpoints. The July 2026 advisory does not name a specific weakness class, and no CWE has been assigned in NVD.

Attack Vector

The attack path is remote and network-based over HTTP. An attacker sends crafted requests to an exposed Coherence HTTP endpoint. No authentication, privileges, or user interaction are required. On success, the attacker gains code execution or equivalent control sufficient for a full product takeover, as reflected by the high confidentiality, integrity, and availability impacts in the CVSS vector.

The vulnerability mechanism is described in prose because no verified public exploit code exists at the time of writing. See the Oracle Security Alert July 2026 for vendor-provided context.

Detection Methods for CVE-2026-60272

Indicators of Compromise

Unexpected outbound network connections initiated by Coherence JVM processes to unknown hosts.
New or modified files inside Coherence installation directories or the JVM temporary directory following inbound HTTP traffic.
Java child processes such as cmd.exe, powershell.exe, bash, or sh spawned by the Coherence server process.
HTTP requests to Coherence management or extend endpoints containing serialized Java payloads or unusually large POST bodies.

Detection Strategies

Inspect HTTP access logs on Coherence hosts for anomalous request paths, oversized payloads, or requests from unexpected source ranges.
Alert on Coherence JVM processes creating shells, writing to disk outside expected working directories, or loading unfamiliar Java classes at runtime.
Correlate WAF and reverse proxy telemetry with Coherence host events to identify pre-exploitation reconnaissance patterns.

Monitoring Recommendations

Baseline the parent-child process tree of Coherence JVMs and alert on deviations.
Enable and forward weblogic.log, Coherence cluster logs, and JVM garbage collection logs to a central platform for correlation.
Monitor egress from Coherence subnets and block by default; treat any outbound HTTP or DNS from grid nodes as suspicious.

How to Mitigate CVE-2026-60272

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to every Coherence instance running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Inventory all Coherence deployments, including embedded uses inside other Fusion Middleware products, and confirm patch coverage.
Restrict network access to Coherence HTTP listeners so that only trusted application tiers can reach them.
Review Coherence and application logs for signs of exploitation predating patch application.

Patch Information

Oracle addressed CVE-2026-60272 in the July 2026 Critical Patch Update. Patches are distributed through My Oracle Support and are cumulative for each affected version line. Refer to the Oracle Security Alert July 2026 for the download matrix and version-specific instructions.

Workarounds

Place Coherence HTTP endpoints behind an authenticated reverse proxy that enforces allow-listed source IPs until patching is complete.
Disable or firewall any Coherence REST, management, or extend HTTP listeners that are not required by production workloads.
Enforce strict egress filtering on Coherence hosts to limit post-exploitation lateral movement and command-and-control traffic.

bash

# Example iptables egress restriction for a Coherence host
iptables -A OUTPUT -p tcp --dport 80 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -m owner --uid-owner coherence -j DROP
iptables -A INPUT -p tcp --dport 8080 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP