CVE-2026-60275: Oracle Coherence RCE Vulnerability

CVE-2026-60275 Overview

CVE-2026-60275 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can exploit this flaw to compromise the affected Coherence instance. Successful exploitation results in full takeover of Oracle Coherence, impacting confidentiality, integrity, and availability.

Oracle disclosed the issue in its July 2026 Critical Patch Update. The affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Because Coherence is commonly deployed as an in-memory data grid backing enterprise applications, exploitation exposes middleware-layer data and downstream systems.

Critical Impact
Unauthenticated network attackers can achieve full takeover of Oracle Coherence with no user interaction, yielding complete compromise of confidentiality, integrity, and availability.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60275 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60275

Vulnerability Analysis

The flaw resides in the Core component of Oracle Coherence and is reachable over HTTP. According to Oracle's advisory, the vulnerability is easily exploitable and requires no authentication, no privileges, and no user interaction. A successful attack results in a full takeover of the Coherence instance, meaning the attacker gains control over the middleware process, its data grid, and any data cached within it.

Oracle Coherence is typically deployed as a distributed in-memory data grid for latency-sensitive applications. Compromise of a Coherence node commonly extends into connected application servers, session state, and cached credentials or business data. The EPSS probability at publication is 0.486%.

Root Cause

Oracle has not published low-level technical details for CVE-2026-60275 beyond the advisory. Historically, remote takeover flaws in Oracle Coherence have originated from unsafe deserialization of untrusted objects received over network protocols exposed by the Core component. The advisory characterization — unauthenticated, network-adjacent, HTTP-reachable, full impact to C/I/A — is consistent with a deserialization or remote code execution primitive in the Core services.

Attack Vector

An attacker sends a crafted HTTP request to an exposed Coherence endpoint. Because no authentication is required, any network path to the service is sufficient, including internal networks reachable through a pivot. Successful requests lead to arbitrary code execution in the context of the Coherence process, enabling data exfiltration, lateral movement, and persistence.

No verified public proof-of-concept code was available at the time of writing. Refer to the Oracle Critical Patch Update - July 2026 for authoritative technical details.

Detection Methods for CVE-2026-60275

Indicators of Compromise

Unexpected outbound network connections from Coherence JVM processes to unknown hosts following inbound HTTP traffic.
New or modified files under Coherence installation and working directories, or unexpected child processes spawned by the Coherence Java process.
HTTP requests to Coherence management or extend endpoints containing serialized Java payloads or unusually large bodies.

Detection Strategies

Inspect application and access logs for anomalous HTTP POST requests to Coherence listener ports, particularly with Content-Type: application/x-java-serialized-object or binary payloads.
Alert on Coherence JVM processes spawning shells (sh, bash, cmd.exe, powershell.exe) or scripting interpreters, which indicate post-exploitation activity.
Correlate authentication-free HTTP access to Coherence endpoints with subsequent outbound connections or file writes on the host.

Monitoring Recommendations

Enable verbose HTTP access logging on all Coherence nodes and forward logs to a centralized SIEM for retention and correlation.
Baseline normal Coherence process behavior — network peers, child processes, file writes — and alert on deviations.
Monitor Oracle Fusion Middleware inventory for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 that have not received the July 2026 CPU.

How to Mitigate CVE-2026-60275

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Coherence deployments as the primary remediation.
Inventory every Oracle Fusion Middleware installation and identify Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Restrict network access to Coherence listener ports to trusted management subnets until patching is complete.
Review logs for the last 90 days for signs of unauthenticated access to Coherence HTTP endpoints.

Patch Information

Oracle addressed CVE-2026-60275 in the July 2026 Critical Patch Update. Administrators must apply the vendor-supplied patches for the specific Coherence version in use. See the Oracle Security Alert - July 2026 for patch download links and version-specific instructions.

Workarounds

Place Coherence nodes behind a reverse proxy or firewall that enforces authentication and source IP allow-listing on HTTP endpoints.
Disable or block externally reachable Coherence Extend and management HTTP listeners if not required for operations.
Segment Coherence clusters onto isolated VLANs and deny inbound traffic from user-facing network zones.

bash

# Example: restrict Coherence HTTP listener to management subnet with iptables
iptables -A INPUT -p tcp --dport 9099 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP