CVE-2026-60277: Oracle Coherence RCE Vulnerability

CVE-2026-60277 Overview

CVE-2026-60277 is a network-exploitable vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated remote attacker with TCP network access can compromise the affected server. Successful exploitation results in full takeover of Oracle Coherence, with impacts to confidentiality, integrity, and availability. Oracle disclosed the issue in the Oracle Security Alert July 2026. The attack complexity is rated High, meaning the attacker must satisfy specific conditions to succeed, but no user interaction or credentials are required.

Critical Impact
An unauthenticated attacker reaching the Coherence TCP listener over the network can achieve complete takeover of the Coherence cluster, impacting confidentiality, integrity, and availability.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60277 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60277

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used for distributed caching and cluster coordination across Fusion Middleware deployments. The flaw resides in the Core component and is reachable over TCP without authentication. Oracle categorizes the issue as difficult to exploit, indicating conditions outside the attacker's direct control must be met. When exploitation succeeds, the attacker gains takeover of the Coherence process, exposing cached data, application state, and any downstream systems the cluster interacts with. The unchanged scope in the CVSS vector indicates the impact remains within the vulnerable component, yet full takeover of a data grid typically cascades into broader Fusion Middleware compromise.

Root Cause

Oracle has not published root-cause details in the public advisory. The Core component of Coherence handles cluster membership, remote invocation, and object exchange over TCP. Vulnerabilities in this surface historically involve unsafe deserialization or protocol handling flaws that permit remote code execution. Refer to the Oracle Security Alert July 2026 for authoritative technical guidance.

Attack Vector

The attacker connects to an exposed Coherence TCP port from the network. No credentials or user interaction are required. Because Coherence cluster ports are frequently reachable inside data-center networks, an attacker with a foothold in an adjacent segment can reach the listener. Successful attacks yield read/write access to cluster data and code execution in the Coherence JVM context.

No verified public exploit code is available at this time. Technical details are described in prose in accordance with vendor disclosure.

Detection Methods for CVE-2026-60277

Indicators of Compromise

Unexpected TCP connections to Coherence cluster ports (default 7574 for multicast-less discovery, plus dynamically allocated Coherence Extend and TCMP ports) from hosts outside the cluster membership list.
New or unfamiliar child processes spawned by the Coherence or WebLogic JVM, including shell interpreters or scripting utilities.
Anomalous outbound network activity from Coherence server nodes, particularly to non-corporate destinations.

Detection Strategies

Inventory Coherence deployments and correlate installed versions against the affected list (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0).
Enable and review Coherence and WebLogic diagnostic logs for deserialization warnings, unexpected class loads, or Extend proxy authentication anomalies.
Deploy network intrusion detection signatures on Coherence TCMP and Extend traffic patterns originating from non-cluster hosts.

Monitoring Recommendations

Monitor process lineage of the Coherence JVM for unexpected child processes and command-line arguments.
Alert on egress connections from Fusion Middleware hosts to external addresses, including DNS lookups for non-corporate domains.
Track file writes to WebLogic and Coherence directories, especially .jar, .class, and script files placed after the last patch window.

How to Mitigate CVE-2026-60277

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for all affected Coherence versions immediately.
Restrict TCP access to Coherence cluster and Extend ports using firewall rules, so only trusted cluster members and application tiers can connect.
Audit exposure by scanning for Coherence listeners reachable from user networks or the internet and remove such exposure.

Patch Information

Oracle addressed CVE-2026-60277 in the July 2026 Critical Patch Update. Patch details, download links, and version-specific instructions are published in the Oracle Security Alert July 2026. Apply the patch on all Coherence nodes, including standby and disaster-recovery clusters, and restart affected JVMs.

Workarounds

Place Coherence clusters on isolated network segments with strict allow-lists for peer nodes and application clients.
Enable Coherence Extend proxy authentication and TLS on cluster communication channels where supported.
Disable unused Coherence Extend endpoints and remove default or test configurations from production hosts.

bash

# Example iptables restriction limiting Coherence TCMP/Extend ports to trusted peers
iptables -A INPUT -p tcp -m multiport --dports 7574,9099,20000:20100 \
  -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 7574,9099,20000:20100 \
  -j DROP