CVE-2026-60281: Oracle Coherence Privilege Escalation

CVE-2026-60281 Overview

CVE-2026-60281 affects the Oracle Coherence product of Oracle Fusion Middleware. The vulnerability resides in the Core component and allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running Oracle Coherence to compromise the platform. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, along with complete read access to all Oracle Coherence accessible data.

Critical Impact
Adjacent-network attackers can read and modify all data accessible to Oracle Coherence without authentication or user interaction, breaking the confidentiality and integrity of clustered application state.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60281 published to NVD
2026-07-23 - Last updated in NVD database
Vendor advisory published as part of the Oracle Security Advisory July 2026

Technical Details for CVE-2026-60281

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used for distributed caching, clustered state management, and low-latency data access across Oracle Fusion Middleware deployments. Cluster members communicate over a shared network segment using Coherence's clustering protocol. CVE-2026-60281 exposes this cluster communication to unauthenticated adjacent-network attackers.

An attacker positioned on the same physical or logical layer-2 segment as a Coherence node can interact with the Core component without presenting credentials. This attack path yields unauthorized creation, deletion, or modification access to all data managed by the grid. The attacker also gains full read access to that data, undermining the integrity guarantees that applications rely on when reading cached state.

EPSS currently rates the probability of exploitation at 0.238%. No public proof-of-concept, exploit code, or in-the-wild activity has been observed at the time of publication.

Root Cause

The Oracle advisory attributes the flaw to the Core component of Oracle Coherence. Based on the disclosed impact profile, the underlying weakness relates to missing authentication and access control on cluster-facing protocol handlers. Any node reachable on the communication segment is treated as trusted, allowing operations on grid data without identity verification.

Attack Vector

Exploitation requires network adjacency to a Coherence node — for example, a compromised host, hypervisor tenant, or malicious device on the same VLAN or subnet used by Coherence cluster traffic. The attacker sends crafted messages over the Coherence clustering protocol to read, write, or delete cached entries. No authentication, privileges, or user interaction are required, and attack complexity is low.

Because Coherence often stores session state, cached credentials, business objects, and pre-computed results for upstream Fusion Middleware applications, data tampering can propagate into dependent Java EE workloads.

No verified public exploitation code exists. Refer to the Oracle Security Advisory July 2026 for vendor-provided technical details.

Detection Methods for CVE-2026-60281

Indicators of Compromise

Unexpected cluster join events or new member IDs appearing in Coherence logs from hosts not part of the sanctioned inventory.
Anomalous cache mutations (puts, removes, invalidations) that do not correlate with legitimate application activity.
Traffic to Coherence Tangosol Cluster Management Protocol (TCMP) ports from unauthorized MAC or IP addresses on the cluster VLAN.

Detection Strategies

Enable Coherence audit logging and cluster membership logging, then baseline expected member identities and IP addresses.
Monitor Coherence multicast and unicast traffic patterns for volume spikes, malformed packets, or unusual source hosts.
Correlate application-tier data anomalies (unexpected cache misses, corrupted objects) with Coherence cluster event timelines.

Monitoring Recommendations

Forward Coherence, WebLogic, and host logs to a centralized analytics platform for cross-source correlation.
Alert on any new host establishing sessions to Coherence cluster ports outside the approved node list.
Track lateral movement toward Fusion Middleware subnets, since adjacency to Coherence hosts is the prerequisite for exploitation.

How to Mitigate CVE-2026-60281

Immediate Actions Required

Apply the Oracle Critical Patch Update from the Oracle Security Advisory July 2026 to all affected Coherence versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Inventory all Coherence clusters and confirm patch coverage across development, staging, and production environments.
Restrict layer-2 and layer-3 reachability to Coherence cluster segments to trusted nodes only.

Patch Information

Oracle addressed CVE-2026-60281 in the July 2026 Critical Patch Update. Administrators should install the patch bundle corresponding to each deployed version and validate cluster health after upgrade. Coordinate rolling restarts across cluster members to avoid data loss during patching.

Workarounds

Isolate Coherence cluster traffic on a dedicated VLAN with strict access control lists limiting membership to known node IP and MAC addresses.
Enable Coherence Security Framework features, including cluster member authentication and TLS-secured cluster transport, where supported by the deployed version.
Disable multicast cluster discovery in favor of well-known addresses (WKA) lists that enumerate authorized nodes.

bash

# Example: restrict Coherence cluster membership using Well-Known Addresses (WKA)
# tangosol-coherence-override.xml snippet
# <unicast-listener>
#   <well-known-addresses>
#     <socket-address id="1"><address>10.10.20.11</address><port>7574</port></socket-address>
#     <socket-address id="2"><address>10.10.20.12</address><port>7574</port></socket-address>
#   </well-known-addresses>
# </unicast-listener>
# Combine with host firewall rules:
iptables -A INPUT -p tcp --dport 7574 -s 10.10.20.0/28 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP