CVE-2026-60279: Oracle Coherence RCE Vulnerability

CVE-2026-60279 Overview

CVE-2026-60279 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can compromise Oracle Coherence and achieve complete product takeover. Oracle disclosed the flaw in the Oracle Security Alert July 2026. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Successful exploitation results in full compromise of confidentiality, integrity, and availability.

Critical Impact
An unauthenticated remote attacker can take over Oracle Coherence instances over HTTP without user interaction, leading to complete system compromise.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60279 published to NVD following Oracle's Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60279

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used in distributed caching and enterprise Java applications. The Core component contains a flaw that allows unauthenticated attackers to reach exploitable code paths through standard HTTP requests. The attack requires no privileges and no user interaction. A successful attack yields full takeover of the Coherence instance, meaning attackers gain control over cached data, cluster operations, and any application logic executed by the grid. The vulnerability affects all supported Coherence versions (12.2.1.4.0 through 15.1.1.0.0), indicating the defect resides in long-standing shared code. The EPSS probability is 0.358% (28th percentile), reflecting current absence of public exploitation data.

Root Cause

Oracle's advisory does not publicly disclose the underlying defect class. Historical Coherence vulnerabilities have involved insecure deserialization and improper handling of untrusted input over network protocols. Enterprises should consult the Oracle Security Alert July 2026 for detailed technical context available to licensed customers.

Attack Vector

The attack originates from the network over HTTP. An attacker sends a crafted request to an exposed Coherence endpoint. Because authentication is not required, any host able to reach the service can attempt exploitation. Coherence deployments that expose management, cluster, or REST endpoints to untrusted networks face the highest risk. No public proof-of-concept code is available at this time.

Detection Methods for CVE-2026-60279

Indicators of Compromise

Unexpected HTTP requests to Oracle Coherence management, REST, or cluster ports originating from untrusted sources
New or unusual Java processes spawned by Coherence JVMs, including command shells or scripting interpreters
Outbound network connections from Coherence hosts to unknown external IP addresses
Modifications to Coherence configuration files or unexpected changes to cached data sets

Detection Strategies

Inspect web server and reverse proxy logs for anomalous request patterns targeting Coherence HTTP endpoints
Monitor Coherence application logs for deserialization errors, class loading anomalies, and unexpected authentication failures
Correlate JVM process activity with parent-child process relationships to identify code execution originating from the Coherence runtime

Monitoring Recommendations

Enable verbose HTTP access logging on all Coherence-facing listeners and forward logs to a centralized SIEM
Baseline normal Coherence network traffic and alert on deviations in request volume, source geography, or user-agent strings
Track file integrity on Coherence installation directories and configuration paths

How to Mitigate CVE-2026-60279

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Coherence installations immediately
Inventory all Coherence deployments and confirm exposure of HTTP endpoints to untrusted networks
Restrict network access to Coherence management and cluster ports using firewall rules and network segmentation
Review logs for signs of prior exploitation attempts targeting Coherence HTTP interfaces

Patch Information

Oracle released fixes for CVE-2026-60279 in the July 2026 Critical Patch Update. Administrators should download and apply the appropriate patches for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Refer to the Oracle Security Alert July 2026 for patch identifiers and installation instructions.

Workarounds

Place Coherence servers behind an authenticated reverse proxy or web application firewall to filter unauthenticated HTTP requests
Disable any Coherence HTTP endpoints not required for production operation
Enforce mutual TLS on Coherence cluster and management communications to limit exposure while patching is planned

bash

# Example: restrict Coherence HTTP port access with iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP