CVE-2026-60274: Oracle Coherence RCE Vulnerability

CVE-2026-60274 Overview

CVE-2026-60274 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via TCP can compromise Oracle Coherence without user interaction. Successful exploitation results in full takeover of the affected Oracle Coherence instance, with high impact to confidentiality, integrity, and availability.

The issue affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle addressed the flaw in its July 2026 Critical Patch Update.

Critical Impact
Remote, unauthenticated attackers can take over Oracle Coherence clusters over the network, gaining full read, write, and denial-of-service capability against in-memory data grid deployments.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - Oracle publishes fix in the July 2026 Critical Patch Update
2026-07-21 - CVE-2026-60274 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60274

Vulnerability Analysis

Oracle Coherence is a distributed in-memory data grid used for caching, data management, and clustering across Fusion Middleware deployments. Coherence nodes communicate over TCP using proprietary cluster and extend protocols that transport serialized Java objects between members and clients.

The vulnerability sits in the Core component and is reachable by any attacker able to send TCP traffic to a Coherence listener. Oracle rates the flaw as easily exploitable and requires no privileges or user interaction. Successful exploitation yields full takeover of the Coherence process, which typically runs with the privileges of the hosting WebLogic or Java application server.

Because Coherence often stores session state, cached credentials, and business data, takeover extends beyond code execution to complete compromise of the data grid contents. According to EPSS data from 2026-07-23, this CVE carries a probability of 0.486%.

Root Cause

Oracle has not published a technical root-cause breakdown. Historical Coherence flaws with the same profile of unauthenticated network takeover have stemmed from insecure Java deserialization in the cluster and Coherence*Extend protocols, where attacker-supplied serialized objects are processed before authentication. Refer to the Oracle Security Alert July 2026 for authoritative details.

Attack Vector

The attack originates over the network via TCP against a Coherence cluster port or extend proxy. No credentials, configuration knowledge, or user interaction are required. An attacker sends a crafted payload to the listening Coherence service and triggers takeover of the process. Public proof-of-concept code is not currently listed in the enriched data.

Detection Methods for CVE-2026-60274

Indicators of Compromise

Unexpected inbound TCP connections to Coherence cluster ports (default 9099, 7574 for name service, and any configured Extend proxy ports) from untrusted networks.
Java processes hosting Coherence spawning shell interpreters such as sh, bash, cmd.exe, or powershell.exe.
New or modified files in Coherence and WebLogic domain directories that were not created by an administrator or automated deployment pipeline.
Outbound connections from Coherence JVMs to unknown external hosts, indicating post-exploitation command-and-control activity.

Detection Strategies

Alert on child processes of java command lines containing coherence.jar, com.tangosol, or DefaultCacheServer.
Inspect network flows for Coherence protocol traffic crossing security zone boundaries, especially from user or DMZ segments toward application tiers.
Correlate authentication logs with Coherence JVM activity to identify process behavior that occurs without a corresponding administrative session.

Monitoring Recommendations

Enable JVM audit logging and forward Coherence and WebLogic logs to a centralized platform for retention and correlation.
Baseline normal Coherence cluster membership events and alert on unexpected member joins or role changes.
Monitor for changes to Coherence configuration files including tangosol-coherence-override.xml and cache configuration XML.

How to Mitigate CVE-2026-60274

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Coherence deployments running affected versions.
Inventory Coherence instances across development, test, and production, including embedded deployments within WebLogic domains.
Restrict Coherence cluster and Extend proxy ports to trusted management networks using host firewalls and network ACLs.
Rotate credentials, tokens, and cached secrets that may have been exposed through Coherence caches on unpatched systems.

Patch Information

Oracle released fixes for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 as part of the Oracle Security Alert July 2026. Administrators must download the applicable patch for each Coherence version from My Oracle Support and apply it following Oracle's standard patching procedure for Fusion Middleware.

Workarounds

Enable Coherence Security Framework and TLS on all cluster and Extend communication to require authenticated, encrypted transport.
Block Coherence TCP ports at the network perimeter and permit access only from application servers that require it.
Deploy Coherence inside an isolated network segment where only trusted client tiers can initiate connections.

bash

# Example: restrict Coherence Extend proxy port with iptables
iptables -A INPUT -p tcp --dport 9099 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP