CVE-2026-60295: Oracle Coherence RCE Vulnerability

CVE-2026-60295 Overview

CVE-2026-60295 is a high-severity vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows a low-privileged attacker with network access over TCP to compromise Oracle Coherence. Successful exploitation results in full takeover of the affected Coherence deployment. The vulnerability carries a scope change, meaning attacks can significantly impact additional products beyond Coherence itself. Oracle disclosed the issue in its July 2026 Critical Patch Update advisory.

Critical Impact
Successful exploitation results in takeover of Oracle Coherence with confidentiality, integrity, and availability impacts extending to adjacent products through scope change.

Affected Products

Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE CVE-2026-60295 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60295

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle Coherence, an in-memory data grid used for distributed caching and computation in Oracle Fusion Middleware deployments. An authenticated attacker holding low-privilege credentials can send crafted traffic over TCP to compromise the Coherence service. The attack complexity is rated as high, indicating that exploitation depends on specific conditions beyond the attacker's direct control. Once exploitation succeeds, the attacker achieves complete takeover of the Coherence instance, with impact extending beyond the vulnerable component through a scope change. The current EPSS probability is 0.345%, placing the CVE in the 26.978 percentile for near-term exploitation likelihood.

Root Cause

Oracle has not published detailed technical information about the root cause. The July 2026 Critical Patch Update advisory categorizes the flaw within the Core component and confirms confidentiality, integrity, and availability impacts. Coherence historically exposes cluster services over TCP that process serialized objects and control messages, which are common sources of takeover-class flaws in distributed data grids.

Attack Vector

Exploitation requires network access to a Coherence TCP listener and a valid low-privileged account. The attacker sends specially crafted traffic to trigger the flaw. Because the scope changes, the compromise can propagate beyond Coherence and affect applications relying on the grid for state and coordination. No public proof-of-concept exploit has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Refer to the Oracle Security Alert July 2026 for authoritative technical guidance.

Detection Methods for CVE-2026-60295

Indicators of Compromise

Unexpected TCP connections to Coherence cluster ports (default 7574 for cluster discovery and dynamic member ports) from unusual source hosts.
Anomalous authentication events for low-privileged Coherence or WebLogic accounts followed by cluster membership changes.
New or unexpected Java processes spawned by Coherence node JVMs, or outbound connections initiated by Coherence servers.

Detection Strategies

Correlate Coherence and WebLogic access logs with network flow data to identify low-privileged sessions issuing cluster-level operations.
Monitor JVM behavior on Coherence nodes for reflective class loading, unexpected child processes, or file writes outside standard deployment paths.
Compare deployed Coherence versions against the affected list (14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) using configuration management inventory.

Monitoring Recommendations

Enable audit logging for Coherence management operations and forward events to a centralized analytics platform.
Alert on scope-changing behavior such as Coherence nodes accessing databases, message brokers, or identity services outside baseline patterns.
Track patch deployment status across all Fusion Middleware hosts and flag any Coherence instance still on an affected build.

How to Mitigate CVE-2026-60295

Immediate Actions Required

Apply the fixes from the Oracle July 2026 Critical Patch Update to every Coherence deployment running an affected version.
Inventory all Oracle Coherence nodes and identify versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 for prioritized patching.
Restrict TCP access to Coherence cluster and management ports to trusted hosts and administrative networks only.
Review and reduce the number of accounts with any Coherence privileges to shrink the pool of usable attacker credentials.

Patch Information

Oracle released fixes as part of the Oracle Security Alert July 2026. Administrators should apply the corresponding Coherence patches for versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 following Oracle's Critical Patch Update guidance.

Workarounds

Place Coherence clusters behind network segmentation and firewall rules that block TCP access from untrusted zones until patches are applied.
Rotate credentials for any low-privileged accounts that can reach Coherence services and enforce strong authentication controls.
Enable TLS and mutual authentication on Coherence cluster and extend proxy communications where supported by the deployed version.

bash

# Example: restrict Coherence cluster port access with iptables
iptables -A INPUT -p tcp --dport 7574 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP