CVE-2026-60273: Oracle Coherence RCE Vulnerability

CVE-2026-60273 Overview

CVE-2026-60273 affects the Oracle Coherence product within Oracle Fusion Middleware, specifically the Core component. The flaw allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful exploitation results in full takeover of the affected Oracle Coherence instance, impacting confidentiality, integrity, and availability. Oracle rates the exploitation complexity as high, requiring specific conditions for successful attack execution. The vulnerability was disclosed in the Oracle Critical Patch Update advisory published in July 2026.

Critical Impact
Unauthenticated network attackers can achieve complete takeover of Oracle Coherence, compromising confidentiality, integrity, and availability of the middleware cluster.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE CVE-2026-60273 published to NVD as part of Oracle Critical Patch Update July 2026
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60273

Vulnerability Analysis

Oracle Coherence is a distributed in-memory data grid used across Oracle Fusion Middleware deployments for caching, session management, and low-latency data access. The vulnerability resides in the Core component and is reachable over TCP without authentication. Attackers who successfully exploit the flaw can take over the Coherence instance, gaining control over cached data, cluster nodes, and any services relying on the grid.

Exploitation is rated difficult by Oracle, indicating that specific runtime conditions, network positioning, or timing must align for the attack to succeed. However, the lack of authentication requirements means external network exposure of Coherence TCP ports substantially increases risk. Oracle has not published a CWE classification for this issue, but Coherence has historically been affected by insecure deserialization vulnerabilities exposed through its cluster and extend protocols.

Root Cause

Oracle has not disclosed detailed root-cause information beyond identifying the Core component of Coherence. The advisory indicates the flaw is reachable via TCP and does not require credentials or user interaction. Refer to the Oracle Security Alert July 2026 for authoritative technical context.

Attack Vector

An attacker sends crafted network traffic to a TCP listener exposed by an Oracle Coherence node. Because no authentication is required, any host that can reach the Coherence cluster port is a potential source of attack. Successful exploitation grants control equivalent to a trusted cluster participant, enabling data manipulation, service disruption, and code execution paths tied to Coherence internals.

No public proof-of-concept code is available. See the Oracle Security Alert July 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-60273

Indicators of Compromise

Unexpected inbound TCP connections to Coherence cluster or Extend proxy ports from untrusted networks.
New or unauthorized Coherence cluster members joining the grid without prior configuration changes.
Anomalous Java process activity on Coherence hosts, including unexpected child processes or outbound network callbacks.
Log entries indicating deserialization errors, class loading failures, or unexpected invocation service requests.

Detection Strategies

Monitor Coherence server logs for unusual InvocationService, ExtendProxy, or cluster join events originating from unknown IP addresses.
Correlate host-level telemetry from Coherence JVMs with network flow data to identify unauthorized TCP connections.
Alert on Java processes spawning shells, PowerShell, or scripting interpreters on middleware hosts.

Monitoring Recommendations

Baseline expected Coherence cluster membership and alert on deviations.
Capture and retain JVM stack traces and deserialization exceptions for forensic review.
Track patch state of all Fusion Middleware hosts against the July 2026 Critical Patch Update.

How to Mitigate CVE-2026-60273

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Coherence installations (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0).
Inventory all Coherence deployments across production, staging, and disaster recovery environments to confirm patch coverage.
Restrict Coherence cluster and Extend proxy TCP ports to trusted internal networks only.
Audit exposure of Coherence services to the public internet and remove any unnecessary internet-facing listeners.

Patch Information

Oracle addressed CVE-2026-60273 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for patch download instructions, prerequisites, and version-specific guidance.

Workarounds

Enforce network segmentation so that only authorized application servers can reach Coherence TCP ports.
Enable Coherence security features such as TLS for cluster communication and authorized host filtering.
Deploy host-based firewalls on Coherence nodes to limit accepted sources to explicit peer addresses.
Disable unused Coherence Extend proxies and management endpoints until patches are applied.

bash

# Example iptables rules restricting Coherence cluster ports to trusted subnet
iptables -A INPUT -p tcp --dport 7574 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
iptables -A INPUT -p tcp --dport 9099 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP