CVE-2026-60276: Oracle Coherence RCE Vulnerability

CVE-2026-60276 Overview

CVE-2026-60276 is a critical vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, specifically in the Core component. The flaw allows an unauthenticated attacker with network access over HTTPS to compromise Oracle Coherence. Successful exploitation results in full takeover of the Oracle Coherence instance, impacting confidentiality, integrity, and availability. Oracle disclosed the vulnerability in the July 2026 Critical Patch Update. The vulnerability affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Critical Impact
Unauthenticated remote attackers can take over Oracle Coherence over HTTPS with low attack complexity and no user interaction.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0, 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE CVE-2026-60276 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60276

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used across Fusion Middleware deployments for distributed caching and application state management. The vulnerability resides in the Core component and is reachable over HTTPS without authentication. An attacker with network access to the exposed Coherence service can gain full control of the instance. Because Coherence typically stores session data, cache entries, and application state, takeover exposes sensitive data and enables lateral movement into dependent applications. Oracle rates the flaw at the highest severity in its July 2026 Critical Patch Update.

Root Cause

Oracle has not published detailed root-cause information. Historical Oracle Coherence takeover flaws have typically involved unsafe deserialization of untrusted Java objects transmitted through Coherence's clustering and Extend protocols. The exploitability profile of CVE-2026-60276, unauthenticated network access with high confidentiality, integrity, and availability impact, is consistent with a deserialization or protocol-parsing weakness. Refer to the Oracle July 2026 Critical Patch Update for authoritative details.

Attack Vector

The attack vector is network-based over HTTPS. No credentials or user interaction are required. An attacker sends a crafted request to an exposed Oracle Coherence endpoint. Successful exploitation yields code execution or administrative control over the Coherence node, providing a path to compromise linked WebLogic and Fusion Middleware services.

No public proof-of-concept code has been verified for this CVE. See the Oracle Security Alert for vendor-supplied technical detail.

Detection Methods for CVE-2026-60276

Indicators of Compromise

Unexpected inbound HTTPS connections to Oracle Coherence listener ports from untrusted networks.
New or unusual Java child processes spawned by Coherence JVMs, such as shells or scripting interpreters.
Outbound connections from Coherence hosts to unknown external hosts, indicating post-exploitation command and control.
Modifications to Coherence configuration files, cache stores, or on-disk state without a corresponding change ticket.

Detection Strategies

Inventory all Oracle Coherence instances and confirm running versions against the affected list (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0).
Correlate WebLogic and Coherence server logs for anomalous HTTPS requests, deserialization errors, or class-loading warnings.
Deploy network signatures on perimeter and internal segmentation devices to flag unauthenticated traffic to Coherence ports.
Baseline outbound connectivity from Coherence hosts and alert on deviations.

Monitoring Recommendations

Forward Coherence and WebLogic logs to a centralized SIEM for retention and correlation.
Monitor JVM behavior on Coherence hosts for unexpected process trees, file writes, and network sockets.
Track authentication and administrative events on adjacent Fusion Middleware services for signs of lateral movement.

How to Mitigate CVE-2026-60276

Immediate Actions Required

Apply the fixes from the Oracle July 2026 Critical Patch Update to all affected Coherence versions immediately.
Restrict network reachability of Coherence listener ports to trusted management networks and application tiers only.
Audit Coherence deployments exposed to the internet or untrusted zones and take them offline until patched.
Rotate credentials and secrets stored or cached within Coherence if compromise is suspected.

Patch Information

Oracle addressed CVE-2026-60276 in the July 2026 Critical Patch Update. Administrators must apply the patches referenced in the Oracle Security Alert for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle recommends applying Critical Patch Updates without delay.

Workarounds

Place Oracle Coherence behind a network firewall or service mesh that enforces mutual TLS and IP allow-listing.
Disable or block external exposure of Coherence Extend and cluster ports where not required for business operations.
Run Coherence JVMs with least-privilege service accounts to limit the blast radius of a successful compromise.

bash

# Example: restrict Coherence listener to internal segment using iptables
iptables -A INPUT -p tcp --dport 9099 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP