CVE-2026-60289: Oracle Coherence RCE Vulnerability

CVE-2026-60289 Overview

CVE-2026-60289 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access over HTTP can exploit the flaw to fully compromise Oracle Coherence. Successful exploitation results in complete takeover of the affected instance, impacting confidentiality, integrity, and availability.

The vulnerability affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle disclosed the issue in the Oracle Security Alert of July 2026. No public proof-of-concept or in-the-wild exploitation has been confirmed at the time of publication.

Critical Impact
Unauthenticated remote attackers can achieve full takeover of Oracle Coherence instances over HTTP with low attack complexity and no user interaction.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0 and 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60289 published to NVD following the Oracle Critical Patch Update / Security Alert of July 2026
2026-07-23 - Last updated in the NVD database

Technical Details for CVE-2026-60289

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used for distributed caching and data management in Fusion Middleware deployments. The flaw resides in the Core component and is reachable over HTTP without authentication. Oracle categorizes the issue as easily exploitable, meaning an attacker only needs network access to the exposed Coherence endpoint.

Successful exploitation grants the attacker control equivalent to takeover of the Coherence process, including access to cached data, cluster configuration, and code execution paths within the grid. Because Coherence often stores session state and sensitive application data, downstream applications relying on the grid are also at risk. The EPSS probability at publication is 0.486%, reflecting current exploitation likelihood rather than technical severity.

Root Cause

Oracle has not published detailed root-cause information beyond identifying the Core component. Similar historical Coherence takeover issues have stemmed from unsafe deserialization of untrusted objects reaching internal handlers. Administrators should treat the flaw as an unauthenticated remote code execution class vulnerability until Oracle publishes further technical detail in the Oracle Security Alert July 2026.

Attack Vector

The attack vector is network-based over HTTP. No privileges or user interaction are required. An attacker sends crafted HTTP traffic to a reachable Coherence endpoint and gains full control of the target. Coherence deployments exposed to untrusted networks, or reachable through misconfigured reverse proxies and load balancers, are at highest risk.

No verified public exploit code is available. See the Oracle Security Alert July 2026 for vendor-supplied detail.

Detection Methods for CVE-2026-60289

Indicators of Compromise

Unexpected HTTP requests to Oracle Coherence management or cluster ports from external or non-administrative sources.
New or unfamiliar Java processes spawned by the Coherence JVM, including shells, downloaders, or scripting interpreters.
Outbound network connections initiated by the Coherence process to unfamiliar hosts.
Anomalous modifications to cached objects, cluster membership, or Coherence configuration files.

Detection Strategies

Inventory all Oracle Coherence instances and confirm which versions are exposed to HTTP traffic.
Inspect HTTP access logs and reverse-proxy logs for unusual POST bodies or serialized-object payloads directed at Coherence endpoints.
Correlate Coherence JVM child-process creation with network egress to identify post-exploitation activity.
Apply signatures for known Java deserialization payloads at the web application firewall and intrusion prevention system.

Monitoring Recommendations

Enable verbose logging on Coherence HTTP handlers and forward logs to a centralized analytics platform.
Alert on any authentication-less requests reaching Coherence administrative interfaces.
Monitor for changes to Coherence configuration, cluster join events, and unexpected node additions.
Track outbound connections from application servers hosting Coherence to detect command-and-control activity.

How to Mitigate CVE-2026-60289

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Coherence versions without delay.
Restrict network access to Coherence HTTP endpoints so only trusted application servers can reach them.
Audit exposed instances using external attack surface tooling to confirm no Coherence port is reachable from the internet.
Rotate credentials, tokens, and secrets that may have been cached or accessible within Coherence.

Patch Information

Oracle released fixes for CVE-2026-60289 as part of the Oracle Security Alert July 2026. Upgrade Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 to the patched build specified in that advisory. Coordinate patching with dependent Fusion Middleware components to preserve cluster compatibility.

Workarounds

Place Coherence behind a reverse proxy that enforces authentication and strict allowlists on request paths and methods.
Disable or firewall any HTTP-facing Coherence services that are not required for production workloads.
Segment Coherence clusters into isolated network zones with no direct exposure to user or partner networks.
Enforce Java Security Manager or serialization filters where supported to limit deserialization of untrusted classes.

bash

# Example: restrict Coherence HTTP port to trusted subnet only (Linux nftables)
nft add rule inet filter input tcp dport 8080 ip saddr != 10.20.30.0/24 drop
nft add rule inet filter input tcp dport 8080 ip saddr 10.20.30.0/24 accept