CVE-2026-60288 Overview
CVE-2026-60288 is a critical vulnerability in the Core component of Oracle Coherence, a distributed in-memory data grid within Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker with network access via TCP to fully compromise affected Oracle Coherence deployments. Successful exploitation results in complete takeover of the Coherence cluster, impacting confidentiality, integrity, and availability. Affected supported versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle disclosed the issue in the July 2026 Critical Patch Update.
Critical Impact
Unauthenticated attackers can achieve full takeover of Oracle Coherence clusters over the network, exposing enterprise data caches and application state.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60288 published to NVD alongside the Oracle July 2026 Critical Patch Update
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60288
Vulnerability Analysis
The vulnerability resides in the Core component of Oracle Coherence, the module that handles cluster communication and data grid operations. An attacker reaches the vulnerable code path over TCP without authentication and without user interaction. The advisory indicates a scope-unchanged compromise with high impact to confidentiality, integrity, and availability, consistent with server-side code execution or full application takeover. Oracle Coherence historically exposes cluster and extend proxy ports that accept serialized payloads, making Core-level flaws attractive targets for pre-authentication attackers.
Root Cause
Oracle has not published component-level source details. The advisory in the Oracle Critical Patch Update classifies the issue in the Coherence Core component and describes takeover as the outcome, which aligns with unsafe processing of attacker-supplied data received on Coherence cluster or proxy listeners. Similar prior Coherence issues have stemmed from insecure deserialization of Java objects transmitted between cluster members and clients.
Attack Vector
Exploitation requires network reachability to a Coherence listener, typically the cluster port (default 7574) or an Extend proxy port used by remote clients. No credentials are required. An attacker on the same network segment, or through an exposed management or proxy interface, can send crafted TCP traffic to a vulnerable node to trigger the takeover condition. See the Oracle Security Alert July 2026 for authoritative details.
No verified proof-of-concept code is available at time of publication.
Refer to the Oracle Critical Patch Update advisory for technical guidance.
Detection Methods for CVE-2026-60288
Indicators of Compromise
- Unexpected inbound TCP connections to Coherence cluster port 7574 or configured Extend proxy ports from untrusted networks.
- New or unexpected child processes spawned by the JVM running Coherence, such as shells, scripting interpreters, or download utilities.
- Anomalous outbound network activity from Coherence hosts, including connections to unfamiliar IP addresses or DNS lookups for attacker infrastructure.
- Unexplained modifications to Coherence configuration files, cache stores, or on-disk artifacts under the WebLogic or Coherence installation directories.
Detection Strategies
- Monitor Coherence JVM processes for behavior that deviates from application baselines, especially command execution or filesystem writes outside the installation path.
- Inspect Coherence and WebLogic logs for deserialization exceptions, class-not-found errors, or unexpected client connections preceding process anomalies.
- Correlate network telemetry for TCP sessions to Coherence ports originating from hosts that are not sanctioned cluster members or application clients.
Monitoring Recommendations
- Enable verbose logging on Coherence cluster and proxy services and forward logs to a central SIEM for retention and correlation.
- Alert on new listeners, unexpected outbound connections, or privilege changes on Coherence hosts.
- Track patch state of Oracle Fusion Middleware assets to identify unpatched Coherence versions still exposed on the network.
How to Mitigate CVE-2026-60288
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle Coherence deployments running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
- Restrict network access to Coherence cluster and Extend proxy ports so only sanctioned cluster members and application servers can reach them.
- Inventory all Coherence instances, including those embedded in WebLogic and custom applications, and prioritize patching internet-adjacent nodes first.
Patch Information
Oracle published fixes for CVE-2026-60288 as part of the Critical Patch Update released in July 2026. Administrators should download and apply the patch bundle for their Fusion Middleware version as documented in the Oracle Security Alert July 2026.
Workarounds
- Place Coherence clusters on isolated network segments and enforce strict firewall rules limiting inbound TCP to known peers.
- Enable Coherence Transport Layer Security (TLS) and configure authorized host filters to reject unauthorized cluster join attempts.
- Where feasible, disable or firewall Extend proxy endpoints that are not required, reducing exposure of the vulnerable Core code paths.
# Example iptables rules restricting Coherence cluster port to trusted peers
iptables -A INPUT -p tcp --dport 7574 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
