CVE-2026-60284 Overview
CVE-2026-60284 is a high-severity vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker to compromise Oracle Coherence over HTTP without user interaction. Successful exploitation can lead to complete disclosure of Coherence-accessible data and limited unauthorized modification of that data. Oracle addressed the issue in the July 2026 Critical Patch Update.
Affected supported versions include Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Critical Impact
An unauthenticated attacker with network access via HTTP can read all data accessible to Oracle Coherence and perform limited unauthorized inserts, updates, or deletes.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0, 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60284 published to NVD
- 2026-07-23 - Last updated in NVD database
- July 2026 - Oracle releases fix in the Oracle Security Alert July 2026
Technical Details for CVE-2026-60284
Vulnerability Analysis
CVE-2026-60284 resides in the Core component of Oracle Coherence, the in-memory data grid used across Oracle Fusion Middleware deployments. The vulnerability is reachable over HTTP and requires no authentication, no privileges, and no user interaction. Oracle characterizes the issue as easily exploitable, meaning a remote attacker can trigger the flaw with standard HTTP requests to an exposed Coherence endpoint.
Exploitation leads to high confidentiality impact and low integrity impact. Attackers can read all data accessible to Coherence and perform limited insert, update, or delete operations. Availability is not affected. Because Coherence frequently caches session data, entitlements, and business objects for downstream Fusion Middleware services, disclosure can cascade into broader application compromise.
Root Cause
Oracle has not published component-level technical detail beyond the advisory. The affected Core component handles cluster management and data access primitives, and the network-reachable, unauthenticated nature of the flaw is consistent with input handling or access control weaknesses on an HTTP-exposed management or data interface. Refer to the Oracle Security Alert July 2026 for vendor guidance.
Attack Vector
The attack vector is network-based over HTTP. An attacker who can reach a Coherence HTTP listener issues crafted requests to retrieve or manipulate cached objects. No credentials, tokens, or victim interaction are required, making internet-exposed or flat-network Coherence deployments the primary risk surface.
No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication. The current EPSS probability is 0.339%.
Detection Methods for CVE-2026-60284
Indicators of Compromise
- Unexpected HTTP requests to Coherence management or REST endpoints from external or non-application-tier sources.
- Anomalous read volume from Coherence caches, especially bulk enumeration of keys or entries.
- Unauthorized put, remove, or invoke operations recorded in Coherence audit or JMX logs.
- New or modified cache entries that do not correlate with legitimate application activity.
Detection Strategies
- Enable and centralize Coherence logging, including HTTP access logs, JMX operations, and cluster membership events.
- Baseline normal client IPs, user agents, and request patterns against the Coherence HTTP listener and alert on deviations.
- Correlate Coherence access logs with upstream WAF and reverse proxy logs to identify unauthenticated requests reaching internal ports.
- Monitor Fusion Middleware application logs for cache read or write errors that indicate tampering.
Monitoring Recommendations
- Alert on any inbound HTTP traffic to Coherence ports from outside the application tier.
- Track cache mutation rates per source and flag statistical outliers.
- Review authentication and authorization configuration on all Coherence HTTP and REST endpoints on a recurring basis.
How to Mitigate CVE-2026-60284
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 deployments.
- Inventory all Coherence instances, including embedded deployments inside Fusion Middleware products, and confirm patch status.
- Restrict network access to Coherence HTTP and cluster ports so only trusted application tiers can reach them.
- Rotate credentials, tokens, and session data that may have been cached in Coherence if compromise is suspected.
Patch Information
Oracle published the fix as part of the July 2026 Critical Patch Update. See the Oracle Security Alert July 2026 for patch identifiers, download locations, and product-specific installation instructions.
Workarounds
- Block external access to Coherence HTTP listeners at the network firewall or reverse proxy until patches are applied.
- Disable unused Coherence REST and management extensions in coherence-cache-config.xml and operational overrides.
- Enforce authentication and TLS on all Coherence HTTP endpoints and require mutual TLS between cluster members.
- Segment Coherence clusters onto dedicated VLANs with explicit allowlists for client hosts.
# Configuration example: restrict Coherence HTTP listener to loopback
# and require the application tier to proxy requests through an authenticated gateway
-Dcoherence.management.http.host=127.0.0.1
-Dcoherence.management.http=none
-Dcoherence.override=tangosol-coherence-override-secure.xml
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
