CVE-2026-60278 Overview
CVE-2026-60278 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. Supported versions 12.2.1.4.0 and 14.1.1.0.0 are affected. The flaw allows an unauthenticated remote attacker with network access via HTTP to fully compromise Oracle Coherence. Successful exploitation results in complete takeover of the affected instance, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update.
Critical Impact
An unauthenticated attacker can take over Oracle Coherence instances over the network via HTTP with low attack complexity.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Fusion Middleware deployments embedding the above Coherence versions
Discovery Timeline
- 2026-07-21 - CVE-2026-60278 published to NVD
- 2026-07-23 - Last updated in NVD database
- July 2026 - Fix delivered in Oracle Critical Patch Update July 2026
Technical Details for CVE-2026-60278
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used by Oracle Fusion Middleware for distributed caching and clustering. The vulnerability resides in the Core component and is reachable over HTTP without authentication or user interaction. Oracle characterizes the impact as full takeover of Coherence, indicating the attacker gains complete control over the affected process and its data.
The combination of network reachability, low attack complexity, and no required privileges makes this suitable for large-scale opportunistic exploitation once technical details or proof-of-concept code become public. Oracle Coherence commonly runs alongside WebLogic Server and other Fusion Middleware components, so compromise can pivot into broader enterprise application stacks.
Root Cause
Oracle has not published root cause details in the public advisory. Historical Coherence vulnerabilities (such as CVE-2020-2555 and CVE-2020-14756) have stemmed from insecure deserialization in the T3, IIOP, and HTTP handlers, where attacker-controlled serialized Java objects reach gadget chains that trigger remote code execution. The disclosed attack surface, HTTP with no authentication, is consistent with a request-handling flaw in the Core component.
Attack Vector
The attack vector is remote over HTTP. An attacker sends a crafted HTTP request to an exposed Oracle Coherence endpoint. No credentials, user interaction, or prior foothold are required. Coherence services exposed directly to untrusted networks, or reachable through misconfigured reverse proxies and load balancers, are at highest risk.
No verified public exploit code is available in the referenced sources at the time of writing. See the Oracle Critical Patch Update July 2026 for technical details.
Detection Methods for CVE-2026-60278
Indicators of Compromise
- Unexpected outbound network connections originating from Java processes hosting Oracle Coherence (coherence.jar, WebLogic managed servers).
- New or modified child processes spawned by the Coherence JVM, such as shells, curl, wget, or PowerShell.
- Anomalous HTTP POST requests to Coherence management or cluster endpoints from unexpected source IPs.
- Java stack traces in Coherence logs referencing deserialization, ClassNotFoundException, or gadget classes.
Detection Strategies
- Inspect HTTP request bodies to Coherence listeners for serialized Java object markers (aced 0005) or unexpected binary payloads.
- Alert on Coherence JVMs spawning interactive shells or executing operating system commands, which are abnormal for a data-grid process.
- Correlate authentication-less HTTP traffic to Coherence ports with subsequent process, file, and network anomalies on the host.
Monitoring Recommendations
- Enable verbose logging on Coherence HTTP endpoints and forward logs to a centralized analytics platform.
- Baseline normal parent-child process relationships for Fusion Middleware hosts and alert on deviations.
- Monitor egress traffic from middleware subnets for connections to unfamiliar external hosts.
How to Mitigate CVE-2026-60278
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Coherence 12.2.1.4.0 and 14.1.1.0.0 deployments without delay.
- Inventory all Oracle Fusion Middleware installations to identify embedded Coherence components that inherit the vulnerability.
- Restrict network access to Coherence HTTP listeners so they are reachable only from trusted management networks.
- Review recent logs on internet-exposed Coherence hosts for signs of exploitation attempts.
Patch Information
Oracle addressed CVE-2026-60278 in the Oracle Critical Patch Update July 2026. Administrators should apply the patch bundle corresponding to their Coherence release train (12.2.1.4.0 or 14.1.1.0.0) and restart affected Coherence and WebLogic managed servers. Verify the patch inventory using OPatch lsinventory after installation.
Workarounds
- Block external access to Coherence HTTP ports at the network firewall or reverse proxy until patching is complete.
- Place Coherence clusters behind an authenticating gateway that rejects unauthenticated requests to management endpoints.
- Disable any Coherence HTTP-facing services that are not required for business operations.
# Example: restrict Coherence HTTP listener to management subnet using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
