CVE-2026-60285: Oracle Coherence RCE Vulnerability

CVE-2026-60285 Overview

CVE-2026-60285 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access over TCP can compromise the product without user interaction. Successful exploitation results in complete takeover of Oracle Coherence, impacting confidentiality, integrity, and availability. Oracle disclosed the flaw in the July 2026 Critical Patch Update. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability is easily exploitable and applies to any Coherence deployment reachable over the network.

Critical Impact
Unauthenticated network attackers can achieve full takeover of Oracle Coherence instances, exposing clustered application data and enabling downstream compromise of Fusion Middleware environments.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - Oracle published the July 2026 Critical Patch Update addressing CVE-2026-60285
2026-07-21 - CVE-2026-60285 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60285

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used to cluster application state across Fusion Middleware deployments. The Core component exposes cluster and extend services over TCP, allowing nodes and clients to exchange serialized objects and cluster control messages. CVE-2026-60285 is reachable through this network interface without authentication and without user interaction. Successful exploitation results in full compromise of the Coherence process, which typically runs with the privileges of the hosting application server. Because Coherence caches often store session state, credentials, and business objects, takeover of a single node can cascade across the cluster and connected Fusion Middleware services. The vulnerability affects long-supported branches, including Coherence 12.2.1.4.0 and the newer 14.x and 15.x lines, indicating a defect in shared core functionality. Oracle rates the issue as easily exploitable, and its network-accessible profile makes internet-exposed or flat-network deployments especially exposed.

Root Cause

Oracle has not disclosed the specific defect class, and no CWE identifier is currently assigned. Historically, Coherence takeover flaws with the same profile have stemmed from unsafe handling of untrusted serialized payloads processed by cluster and Extend TCP listeners. See the Oracle July 2026 Security Alert for the authoritative advisory.

Attack Vector

An attacker sends crafted TCP traffic to a Coherence listener, such as the cluster port or an Extend proxy endpoint. No credentials, tokens, or user interaction are required. Any host that can reach a Coherence port over the network is a viable source of the attack. Public exploit code and proof-of-concept artifacts have not been observed at time of publication. The current EPSS probability is 0.486% (percentile 39.017), reflecting no observed exploitation activity yet.

No verified public proof-of-concept code is available. Refer to the vendor advisory for authoritative technical details.

Detection Methods for CVE-2026-60285

Indicators of Compromise

Unexpected inbound TCP connections to Coherence cluster ports (default 7574) or Extend proxy ports from untrusted network segments.
New or unfamiliar child processes spawned by Coherence or WebLogic JVMs, particularly shells, curl, wget, or scripting interpreters.
Coherence log entries showing deserialization errors, unexpected class loading, or abrupt member join and eviction events.

Detection Strategies

Inventory all Coherence deployments and correlate installed versions against the affected list of 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Alert on process-lineage anomalies where the Coherence or WebLogic JVM launches interactive shells or writes to web-accessible directories.
Baseline Coherence cluster membership and flag unauthorized nodes joining or Extend clients connecting from unexpected IP ranges.

Monitoring Recommendations

Forward Coherence, WebLogic, and host telemetry to a centralized analytics platform and retain for at least 90 days for retrospective hunts.
Monitor egress from Coherence hosts for outbound connections to unfamiliar destinations, which may indicate post-exploitation command and control.
Track authentication and configuration changes on management interfaces of Fusion Middleware components adjacent to Coherence.

How to Mitigate CVE-2026-60285

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Coherence installations at versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Restrict access to Coherence cluster and Extend TCP ports to trusted management networks using firewall or security-group rules.
Audit Coherence hosts for signs of prior compromise, focusing on JVM child processes, deserialization errors, and unexpected cluster members.

Patch Information

Oracle addressed CVE-2026-60285 in the July 2026 Critical Patch Update. Administrators should download and apply the patch listed for Oracle Coherence in the Oracle July 2026 Security Alert. Patches must be applied to every cluster member, and clusters should be restarted following the vendor's documented rolling-restart procedure.

Workarounds

Block Coherence TCP listener ports at network boundaries so only authorized cluster members and clients can connect.
Place Coherence clusters on a dedicated, segmented VLAN and require VPN or jump-host access for administrators.
Enable Coherence Extend SSL and configure identity-token authorization to reduce exposure until patches are applied.

bash

# Example host-based firewall rules restricting Coherence cluster port 7574
# Adjust CIDR to match the trusted cluster subnet
iptables -A INPUT -p tcp --dport 7574 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP