CVE-2026-60287: Oracle Coherence RCE Vulnerability

CVE-2026-60287 Overview

CVE-2026-60287 is a critical vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, specifically in the Core component. The flaw allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful exploitation results in complete takeover of the affected Oracle Coherence instance, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the Oracle July 2026 Security Alert.

Critical Impact
Unauthenticated remote attackers can take over Oracle Coherence deployments over TCP without user interaction, exposing sensitive middleware data and enabling downstream compromise of applications relying on the caching cluster.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60287 published to the National Vulnerability Database (NVD)
2026-07-23 - CVE-2026-60287 last updated in NVD

Technical Details for CVE-2026-60287

Vulnerability Analysis

Oracle Coherence is a distributed in-memory data grid used across Oracle Fusion Middleware to provide caching, session management, and clustering services. CVE-2026-60287 affects the Core component of Coherence and is exploitable over TCP by an unauthenticated attacker on the network. Oracle characterizes the flaw as easily exploitable, requiring no privileges and no user interaction.

A successful attack results in full takeover of Oracle Coherence. Once an attacker controls a cluster node, they can read or modify cached data, disrupt cluster availability, and pivot toward the Java Virtual Machine (JVM) hosting the process. Historically, Coherence vulnerabilities in this class have involved unsafe handling of Extend or cluster protocol traffic, including insecure deserialization of untrusted Java objects reaching the Coherence port.

Root Cause

Oracle has not published low-level technical details for CVE-2026-60287. Based on the CWE class typical of Coherence Core issues and Oracle's description of unauthenticated network takeover, the root cause is consistent with improper handling of untrusted input arriving on Coherence cluster or Extend proxy ports. Attackers reach the vulnerable code path directly through the Coherence TCP listener without authenticating.

Attack Vector

The attack is network-based over TCP and requires connectivity to the Coherence cluster port or Extend proxy port. Any exposure of these ports beyond trusted management networks turns the affected node into a directly reachable target. Because no authentication is required, a single reachable port is sufficient to achieve takeover of the Coherence process.

No public proof-of-concept exploit is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.486%.

See the Oracle July 2026 Security Alert for vendor guidance.

Detection Methods for CVE-2026-60287

Indicators of Compromise

Unexpected inbound TCP connections to Coherence cluster ports (default 7574) or Extend proxy ports from non-cluster hosts.
New or unexpected child processes spawned by the JVM running Coherence, especially shells, curl, wget, or scripting interpreters.
Coherence log entries showing deserialization errors, class-not-found exceptions, or malformed cluster join requests originating from unknown members.
Outbound connections from Coherence hosts to unfamiliar external addresses following inbound TCP activity.

Detection Strategies

Monitor Coherence and WebLogic JVM processes for anomalous child process creation and unexpected code loading.
Alert on network flows to Coherence ports from IP ranges outside the defined cluster membership.
Correlate authentication-less TCP sessions to Coherence ports with subsequent file writes, credential access, or lateral movement.

Monitoring Recommendations

Enable verbose logging for Coherence cluster membership and Extend proxy connections and forward events to a central data lake.
Track outbound egress from middleware hosts and baseline expected destinations to surface post-exploitation callbacks.
Review inventories to confirm Coherence versions in use and continuously monitor for the affected releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

How to Mitigate CVE-2026-60287

Immediate Actions Required

Apply the fixes provided in the Oracle July 2026 Critical Patch Update to all Oracle Coherence deployments running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Restrict network access to Coherence cluster and Extend ports so only trusted application hosts within the cluster can reach them.
Audit exposure of Coherence ports on internet-facing systems and remove any unintended public exposure immediately.
Rotate credentials and secrets stored or cached in Coherence if compromise cannot be ruled out.

Patch Information

Oracle addressed CVE-2026-60287 in the July 2026 Critical Patch Update. Administrators must download and apply the Coherence patches referenced in the Oracle July 2026 Security Alert for each affected version. Patching is the only vendor-supported remediation for full takeover flaws of this class.

Workarounds

Enforce network segmentation and firewall rules that limit access to Coherence TCP ports to authorized cluster members only.
Place Coherence clusters behind a dedicated management VLAN with no direct routing from user or internet-facing networks.
Enable Coherence Extend authentication and TLS on client-facing proxies to reduce the exposed unauthenticated surface until patches are deployed.

bash

# Example: restrict Coherence cluster port 7574 to trusted subnets using iptables
iptables -A INPUT -p tcp --dport 7574 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP