CVE-2026-60283 Overview
CVE-2026-60283 is an information disclosure vulnerability in the Oracle Coherence product of Oracle Fusion Middleware. The flaw resides in the Core component and affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker with network access via HTTP can exploit the vulnerability to gain unauthorized read access to a subset of Oracle Coherence data. Oracle disclosed the issue in the July 2026 Critical Patch Update.
Critical Impact
Unauthenticated remote attackers can read a subset of Oracle Coherence accessible data over HTTP without user interaction.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0, 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE CVE-2026-60283 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60283
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used in Oracle Fusion Middleware deployments to provide distributed caching and data management. The vulnerability allows a remote attacker with no credentials to interact with an exposed Coherence HTTP endpoint and retrieve data that should be restricted. The scope is limited to confidentiality, with no impact on integrity or availability.
Exploitation requires only network reachability to the affected HTTP interface. Oracle rates the attack complexity as low and confirms no user interaction is required. The vulnerability is classified as an information disclosure issue confined within the same security scope as the vulnerable component.
Root Cause
Oracle has not published a detailed technical root-cause analysis. According to the Oracle July 2026 Security Alert, the flaw exists within the Core component of Coherence and permits unauthorized read access through HTTP-exposed functionality. The defect results in insufficient authorization enforcement on data-accessing operations.
Attack Vector
The attack vector is network-based over HTTP. An unauthenticated attacker sends crafted HTTP requests to the Coherence service endpoint. Successful requests return a subset of data managed by the Coherence cluster. Because privileges are not required, any actor able to reach the service on the network can attempt exploitation. The current EPSS probability is 0.316%, reflecting no confirmed in-the-wild exploitation at this time.
No public proof-of-concept code has been released. Refer to the Oracle advisory for technical guidance.
Detection Methods for CVE-2026-60283
Indicators of Compromise
- Unexpected HTTP requests to Oracle Coherence management or REST endpoints originating from untrusted networks.
- Anomalous outbound data transfer volumes from hosts running Coherence services.
- Access log entries showing repeated queries to Coherence data endpoints without prior authentication events.
Detection Strategies
- Inspect Coherence HTTP access logs for requests to Core component URIs from unauthorized source addresses.
- Correlate application-layer telemetry with network flow data to identify probing of Coherence ports.
- Baseline normal client behavior against Coherence endpoints and alert on deviations.
Monitoring Recommendations
- Enable verbose HTTP request logging on Coherence nodes and forward events to a central SIEM.
- Monitor for scanner user-agents and repeated 200-response patterns against Coherence URLs.
- Track authentication failure rates and anomalous read operations against cached datasets.
How to Mitigate CVE-2026-60283
Immediate Actions Required
- Apply the July 2026 Critical Patch Update from Oracle to all affected Coherence versions.
- Inventory all Coherence deployments and confirm HTTP endpoints are not exposed to untrusted networks.
- Review recent access logs for signs of unauthorized data retrieval.
Patch Information
Oracle addressed CVE-2026-60283 in the Oracle July 2026 Security Alert. Administrators should apply the Critical Patch Update to Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 following Oracle's standard upgrade procedures.
Workarounds
- Restrict network access to Coherence HTTP endpoints using firewalls or segmentation to trusted management networks only.
- Place Coherence services behind an authenticating reverse proxy that enforces access control.
- Disable HTTP-exposed Coherence services that are not required for production workflows.
# Configuration example: restrict Coherence HTTP port with iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
