CVE-2026-60296: Oracle Coherence RCE Vulnerability

CVE-2026-60296 Overview

CVE-2026-60296 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence and achieve full product takeover. Oracle addressed the issue in the July 2026 Critical Patch Update. Affected supported versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Successful exploitation results in complete loss of confidentiality, integrity, and availability across the targeted cluster.

Critical Impact
An unauthenticated remote attacker can take over Oracle Coherence over TCP with low attack complexity, gaining full control of clustered data and application state.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60296 published to NVD
2026-07-23 - Last updated in NVD database
July 2026 - Oracle publishes fix in the Oracle Critical Patch Update

Technical Details for CVE-2026-60296

Vulnerability Analysis

Oracle Coherence provides an in-memory data grid used for distributed caching and application state across Fusion Middleware deployments. The vulnerability resides in the Core component and is reachable over TCP without authentication or user interaction. An attacker who can reach a Coherence cluster port can exploit the flaw to gain arbitrary control over the product.

Coherence historically exposes cluster and extend services via TCP, and cluster members trust incoming protocol messages by default. Flaws in this trust boundary — such as unsafe object handling during message processing — have repeatedly enabled remote takeover. Oracle's advisory categorizes this issue as easily exploitable and network-reachable, consistent with a protocol-level flaw in the Coherence Core.

The EPSS probability is 0.486% (percentile 39.024) as of 2026-07-23. No public proof-of-concept has been observed, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is located in the Coherence Core component. Oracle's advisory does not enumerate a CWE, but the exploitation profile — unauthenticated network access producing full takeover — is characteristic of insecure deserialization or unsafe message handling in a clustered service. Coherence nodes process serialized objects and cluster protocol frames from peers, and any weakness in that pipeline is reachable by any host that can open a TCP session to a member.

Attack Vector

Attack traffic is delivered over TCP to an exposed Coherence listener. The attacker does not need credentials, prior access, or user interaction. A single crafted request is sufficient to compromise the target node, and because Coherence nodes replicate state and code across the cluster, compromise of one member can cascade to the rest.

No verified exploit code is public. Refer to the Oracle Critical Patch Update - July 2026 for vendor-provided technical detail and fixed versions.

Detection Methods for CVE-2026-60296

Indicators of Compromise

Unexpected inbound TCP connections to Coherence cluster or Coherence*Extend proxy ports from hosts outside the trusted cluster subnet.
New or unfamiliar Java processes, child shells, or scripting interpreters spawned by the Coherence JVM.
Outbound network connections from Coherence servers to unknown external hosts, indicating post-exploit callback.
Unexplained ClassNotFoundException, deserialization errors, or cluster membership changes in Coherence logs.

Detection Strategies

Inventory all Coherence deployments and confirm running versions against the fixed releases in the Oracle July 2026 CPU.
Monitor Coherence cluster ports for connections originating outside expected application tiers and alert on anomalies.
Enable and centralize Coherence and JVM logging, then hunt for deserialization stack traces and unexpected class loads.
Correlate process creation on Coherence hosts with the parent Java process to surface command execution spawned by the server.

Monitoring Recommendations

Forward Coherence, WebLogic, and host telemetry to a centralized analytics platform for correlation and long-term retention.
Alert on any Coherence server initiating outbound connections to non-approved destinations.
Track authentication and administrative activity on Fusion Middleware hosts to catch lateral movement after initial compromise.

How to Mitigate CVE-2026-60296

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to every Coherence instance running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Restrict TCP access to Coherence cluster and Extend proxy ports so only trusted application hosts can connect.
Audit Coherence servers for signs of prior exploitation, focusing on process, network, and log anomalies.
Rotate credentials and secrets accessible to compromised or exposed Coherence nodes if any indicators are found.

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update Advisory - July 2026 for the specific patch identifiers and download instructions for each Coherence release train.

Workarounds

Place Coherence clusters behind a firewall or private network segment that blocks untrusted TCP access to member and proxy ports.
Disable or restrict the Coherence*Extend proxy service if it is not required by the application.
Enforce TLS and identity-based authentication on Coherence Extend endpoints where the deployment supports it.
Remove untrusted classes from the Coherence classpath and configure a serialization allowlist for cluster traffic where feasible.

bash

# Example: restrict inbound access to Coherence default cluster port on Linux
# Replace 10.0.0.0/24 with the trusted application subnet
iptables -A INPUT -p tcp --dport 7574 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP

# Example: restrict Coherence*Extend proxy port
iptables -A INPUT -p tcp --dport 9099 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP