CVE-2026-60280: Oracle Coherence RCE Vulnerability

CVE-2026-60280 Overview

CVE-2026-60280 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via HTTP/2 to fully compromise Oracle Coherence deployments. Successful exploitation results in complete takeover of the affected instance, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update. The vulnerability is classified under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Unauthenticated remote attackers can take over Oracle Coherence instances over HTTP/2 without user interaction, leading to full system compromise across affected 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 releases.

Affected Products

Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE CVE-2026-60280 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60280

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle Coherence, Oracle's in-memory data grid product used for distributed caching and application scalability. An attacker reachable over the network can exploit the flaw via HTTP/2 without authentication or user interaction. Successful exploitation yields full takeover, giving the attacker read, modify, and destroy capabilities against Coherence-managed data and processes. Because Coherence often stores session state, cached credentials, and business objects for downstream applications, compromise typically extends beyond the Coherence tier into connected middleware and databases.

Root Cause

The issue is categorized as CWE-306: Missing Authentication for Critical Function. Coherence exposes functionality reachable over HTTP/2 that fails to enforce authentication checks before executing privileged operations. An unauthenticated request can therefore reach code paths that should require identity verification, enabling attacker-controlled logic to run within the Coherence process context.

Attack Vector

Exploitation requires only network reachability to a Coherence HTTP/2 endpoint. No credentials, prior access, or user interaction are needed. In typical deployments, Coherence clusters sit behind application servers on internal networks, but exposed management interfaces, misconfigured proxies, or cloud-hosted instances can broaden the attack surface. Refer to the Oracle Security Alert July 2026 for vendor technical details. No verified public proof-of-concept code is currently available.

Detection Methods for CVE-2026-60280

Indicators of Compromise

Unexpected HTTP/2 requests to Coherence management or cluster ports from untrusted network segments.
Coherence process spawning shells, scripting interpreters, or unusual child processes such as bash, powershell.exe, or cmd.exe.
New or modified serialized objects, cache entries, or MBean invocations that do not correspond to legitimate application traffic.
Outbound connections from Coherence JVMs to unknown IP addresses, particularly over non-standard ports.

Detection Strategies

Inspect HTTP/2 traffic to Coherence endpoints for unauthenticated requests targeting administrative or cluster APIs.
Correlate Coherence audit logs with authentication events to identify privileged actions lacking a preceding successful login.
Baseline JVM child-process behavior for Coherence servers and alert on deviations using EDR telemetry.

Monitoring Recommendations

Enable verbose logging on Coherence HTTP/2 listeners and forward logs to a centralized SIEM for retention and search.
Monitor for anomalous deserialization events or reflective class loading within the Coherence JVM.
Alert on network flows from DMZ or internet-facing systems reaching internal Coherence cluster ports.

How to Mitigate CVE-2026-60280

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 installations without delay.
Inventory all Coherence deployments, including embedded instances shipped with other Fusion Middleware products, and confirm patch status.
Restrict network access to Coherence HTTP/2 endpoints to authorized application tiers using firewall rules or security groups.
Rotate credentials, tokens, and keys stored in or accessible through Coherence caches if compromise is suspected.

Patch Information

Oracle released fixes for CVE-2026-60280 as part of the Oracle Security Alert July 2026. Administrators should follow the Critical Patch Update advisory for version-specific patch identifiers and installation instructions.

Workarounds

Disable or firewall the Coherence HTTP/2 listener where it is not required by applications.
Place Coherence clusters behind an authenticating reverse proxy that enforces mutual TLS on inbound HTTP/2 connections.
Segment Coherence nodes onto isolated management networks with strict east-west access controls until patching is complete.

bash

# Configuration example: restrict Coherence HTTP/2 access with host firewall
# Allow only the application tier subnet to reach the Coherence HTTP/2 port
iptables -A INPUT -p tcp --dport 9099 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP