CVE-2026-60286: Oracle Coherence RCE Vulnerability

CVE-2026-60286 Overview

CVE-2026-60286 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access over HTTP can compromise the affected system and achieve full takeover of Oracle Coherence. The flaw affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle disclosed the issue in the July 2026 Critical Patch Update. The vulnerability impacts confidentiality, integrity, and availability, and it requires no user interaction to exploit.

Critical Impact
Unauthenticated network attackers can take over Oracle Coherence deployments without user interaction, leading to full compromise of the middleware component.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60286 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60286

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used across Oracle Fusion Middleware deployments for distributed caching and application scaling. CVE-2026-60286 resides in the Core component and is remotely exploitable over HTTP without authentication. According to Oracle's advisory, successful exploitation results in complete takeover of Oracle Coherence, meaning attackers gain control over the cache cluster and the data it manages.

The vulnerability is classified as easily exploitable, with attack complexity described as low. The EPSS score is 0.486% with a percentile of 39.018, indicating limited observed exploitation activity at publication but a non-trivial probability of weaponization given the low barrier to attack.

Historically, Oracle Coherence has been targeted through insecure deserialization flaws in its clustering and management protocols, and network-reachable HTTP endpoints in middleware components frequently expose serialized object handling. Oracle's advisory attributes the compromise vector to HTTP, consistent with a network-facing management or service interface.

Root Cause

Oracle has not published low-level technical details in the July 2026 Critical Patch Update beyond the affected component (Core), the attack surface (HTTP), and the impact (full takeover). Refer to the Oracle Critical Patch Update Advisory - July 2026 for the authoritative description.

Attack Vector

The attack originates from the network. An unauthenticated attacker sends crafted HTTP traffic to an exposed Oracle Coherence endpoint. No privileges, credentials, or user interaction are required. The scope is unchanged, but confidentiality, integrity, and availability are each fully impacted, culminating in takeover of the Coherence instance.

No public proof-of-concept or exploit code is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60286

Indicators of Compromise

Unexpected HTTP requests to Oracle Coherence management or cluster ports from untrusted networks.
New or unrecognized Java processes, class loads, or child processes spawned by the Coherence JVM.
Outbound network connections initiated by the Coherence process to attacker-controlled infrastructure.
Unusual modifications to cache entries, cluster membership changes, or new administrative sessions.

Detection Strategies

Inventory all Oracle Coherence instances and confirm running versions against the affected list (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0).
Inspect HTTP access logs for anomalous POST bodies, oversized payloads, or requests to Coherence management URIs from external sources.
Correlate Coherence JVM behavior with endpoint telemetry to identify post-exploitation activity such as shell spawning or credential access.

Monitoring Recommendations

Alert on any Coherence process spawning sh, bash, cmd.exe, powershell.exe, or scripting interpreters.
Monitor for egress connections from Coherence hosts to non-baseline destinations.
Enable audit logging on Coherence and forward it to a centralized SIEM for correlation with network telemetry.

How to Mitigate CVE-2026-60286

Immediate Actions Required

Apply the fixes from the Oracle July 2026 Critical Patch Update to every affected Coherence deployment.
Restrict network access to Coherence HTTP endpoints so they are reachable only from trusted management networks.
Audit recent HTTP access and JVM activity on Coherence hosts for signs of prior exploitation.
Rotate any credentials, keys, or tokens accessible to the Coherence process if compromise is suspected.

Patch Information

Oracle addressed CVE-2026-60286 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update Advisory - July 2026 for patch matrices, download locations, and prerequisite bundle patches for each affected version.

Workarounds

Place Coherence behind a reverse proxy or web application firewall that blocks unauthenticated access to management and cluster endpoints.
Enforce network segmentation and firewall rules to prevent HTTP traffic from untrusted zones reaching Coherence.
Disable or restrict any non-essential HTTP-accessible services exposed by the Coherence Core component until patching is complete.

bash

# Example: restrict inbound HTTP access to Oracle Coherence to a trusted admin subnet
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP