CVE-2026-60290 Overview
CVE-2026-60290 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access over HTTP can compromise the Coherence service without user interaction. Successful exploitation results in full takeover of the affected Oracle Coherence instance, impacting confidentiality, integrity, and availability. Oracle disclosed the flaw in its July 2026 Critical Patch Update. Affected supported versions are 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Critical Impact
An unauthenticated remote attacker can take over Oracle Coherence instances via HTTP, resulting in complete loss of confidentiality, integrity, and availability.
Affected Products
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60290 published to the National Vulnerability Database (NVD)
- 2026-07-23 - Last updated in the NVD database
- July 2026 - Oracle addresses the issue in the Oracle Critical Patch Update Advisory - July 2026
Technical Details for CVE-2026-60290
Vulnerability Analysis
The vulnerability resides in the Core component of Oracle Coherence, an in-memory data grid used within Oracle Fusion Middleware deployments. Oracle rates the issue as easily exploitable and requires no authentication or user interaction. Attackers reach the vulnerable code path through HTTP, meaning any Coherence instance exposed to untrusted networks is at direct risk. Successful exploitation grants attackers control of the Coherence service, which typically holds cached application state, session data, and other business-critical objects.
Because Coherence nodes commonly run with elevated privileges within middleware clusters, takeover can serve as a pivot point to broader Fusion Middleware infrastructure. Attackers can read or manipulate cached data, disrupt application workflows, and execute follow-on actions inside the middleware tier. The EPSS score of 0.486% reflects current exploitation likelihood at publication, though this metric can rise quickly once public exploitation research emerges.
Root Cause
Oracle has not published detailed root-cause information beyond the advisory. Historically, unauthenticated network-reachable takeover flaws in Coherence have involved unsafe processing of untrusted input received over its HTTP-based management or cluster interfaces. Consult the Oracle Security Alert - July 2026 for authoritative technical details.
Attack Vector
The attack vector is network-based over HTTP. An attacker sends crafted HTTP requests to a reachable Oracle Coherence endpoint without needing valid credentials. No user interaction is required, and the scope remains unchanged, meaning the compromise affects the Coherence instance itself. Environments that expose Coherence management interfaces beyond trusted network boundaries face the highest risk.
// No verified proof-of-concept code is publicly available for this CVE.
// Refer to the Oracle Security Alert for authoritative technical details.
Detection Methods for CVE-2026-60290
Indicators of Compromise
- Unexpected HTTP requests to Oracle Coherence management or cluster ports from untrusted networks or unusual source addresses.
- New or modified cache entries, cluster members, or MBean invocations that do not correspond to legitimate application activity.
- Coherence process spawning unexpected child processes such as shells, scripting interpreters, or network utilities.
Detection Strategies
- Inventory all Oracle Coherence deployments and confirm exact versions against 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
- Monitor Coherence and WebLogic logs for anomalous HTTP request patterns, deserialization errors, or authentication-bypass indicators.
- Deploy network-based rules to flag inbound HTTP traffic to Coherence endpoints from non-application sources.
Monitoring Recommendations
- Alert on process lineage anomalies where Coherence Java processes launch operating system commands.
- Track outbound connections from Coherence hosts to unexpected destinations that may indicate command-and-control activity.
- Enable file integrity monitoring on Coherence installation directories and configuration files to catch unauthorized changes.
How to Mitigate CVE-2026-60290
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all affected Oracle Coherence installations without delay.
- Restrict network access to Coherence HTTP endpoints so that only trusted application tiers can reach them.
- Audit Coherence logs and host telemetry for signs of prior exploitation before patching.
Patch Information
Oracle addressed CVE-2026-60290 in the July 2026 Critical Patch Update. Administrators should download and install the fixes referenced in the Oracle Critical Patch Update Advisory - July 2026. Testing patches in a staging environment before production rollout is recommended for clustered Coherence deployments.
Workarounds
- Place Coherence behind an authenticated reverse proxy or firewall that terminates untrusted HTTP traffic.
- Disable or block any Coherence HTTP interfaces that are not required by the application.
- Segment Coherence clusters into isolated network zones with strict egress controls until patching is complete.
# Example: restrict inbound HTTP access to Coherence management port using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
