CVE-2026-60282 Overview
CVE-2026-60282 is a vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, affecting the Core component. Oracle disclosed the issue in the July 2026 Critical Patch Update. The flaw allows a low-privileged attacker with network access via Transmission Control Protocol (TCP) to compromise Oracle Coherence. Successful exploitation results in unauthorized create, update, or delete access to some Oracle Coherence accessible data, along with unauthorized read access to a subset of that data. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Critical Impact
A low-privileged attacker can modify and read a subset of Oracle Coherence data over the network without user interaction.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60282 published to the National Vulnerability Database (NVD)
- 2026-07-23 - Last updated in the NVD database
Technical Details for CVE-2026-60282
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used by Oracle Fusion Middleware for distributed caching and application state management. The vulnerability resides in the Core component and is reachable over TCP, the transport used by Coherence cluster nodes and extend clients. An authenticated attacker holding low privileges can send crafted network traffic to a Coherence endpoint and gain unauthorized write and read access to a subset of accessible data.
The impact is limited to confidentiality and integrity. Availability is not affected, but data integrity violations in a caching layer can propagate to downstream applications relying on cached state for authorization decisions or business logic.
Root Cause
Oracle has not published the underlying weakness class or Common Weakness Enumeration (CWE) identifier for this issue. Based on the disclosed impact, the flaw permits operations against Coherence-managed data that should require higher privileges or stricter validation. Consult the Oracle Security Alert - July 2026 for authoritative technical details.
Attack Vector
The attack path requires network reachability to a Coherence TCP listener and valid low-privilege credentials or a valid session on the target environment. No user interaction is required, and attack complexity is low. Exposure is greatest where Coherence cluster ports or extend proxy ports are reachable from application tiers accessible to semi-trusted users.
No public proof-of-concept exploit or in-the-wild exploitation has been reported at the time of publication. The Exploit Prediction Scoring System (EPSS) probability is 0.183%.
Detection Methods for CVE-2026-60282
Indicators of Compromise
- Unexpected cache entry mutations, deletions, or insertions in Coherence-backed named caches without a corresponding legitimate application transaction.
- New or unusual TCP connections to Coherence cluster or extend proxy ports from application accounts that do not normally interact with the data grid.
- Coherence audit or application logs showing low-privileged principals performing write operations on cache entries outside their expected scope.
Detection Strategies
- Enable Coherence logging at a level that records client connections, authentication events, and cache mutation operations, then forward logs to a centralized analytics platform.
- Baseline normal cache operation patterns per service account and alert on deviations in operation type, entry volume, or source host.
- Correlate Coherence access logs with WebLogic and application-tier authentication logs to identify low-privileged sessions performing sensitive data operations.
Monitoring Recommendations
- Monitor network flows to Coherence cluster ports and extend proxy ports for connections originating outside the approved application tier.
- Track privileged and low-privileged account activity against Coherence management MBeans and JMX endpoints.
- Review Oracle Fusion Middleware patch inventory continuously to confirm the July 2026 Critical Patch Update is applied across all Coherence nodes.
How to Mitigate CVE-2026-60282
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle Coherence deployments running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
- Inventory all Coherence clusters and identify network paths that expose cluster or extend proxy ports beyond the trusted application tier.
- Rotate credentials for low-privileged service accounts that authenticate to Coherence if compromise is suspected.
Patch Information
Oracle addressed CVE-2026-60282 in the July 2026 Critical Patch Update. Refer to the Oracle Security Alert - July 2026 for the specific patch identifiers and installation instructions for each affected version.
Workarounds
- Restrict TCP access to Coherence cluster and extend proxy ports using network segmentation, host firewalls, or security groups so that only authorized application servers can connect.
- Enforce least privilege on Coherence authentication realms and remove unused low-privileged accounts that can reach the data grid.
- Enable Transport Layer Security (TLS) and identity-based authentication on Coherence extend clients and cluster members to reduce the attack surface for unauthenticated network probes.
# Example: restrict Coherence cluster port access with iptables
# Replace 10.0.0.0/24 with your trusted application tier subnet
iptables -A INPUT -p tcp --dport 7574 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
