CVE-2026-60297: Oracle Coherence RCE Vulnerability

CVE-2026-60297 Overview

CVE-2026-60297 is a critical remote code execution vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via TCP can compromise Oracle Coherence and achieve full product takeover. The flaw is easily exploitable and requires no user interaction or prior privileges. Successful exploitation impacts confidentiality, integrity, and availability of the affected system. Oracle addressed the issue in the July 2026 Critical Patch Update. See the Oracle Security Alert July 2026 for full advisory details.

Critical Impact
Unauthenticated attackers can take over Oracle Coherence instances remotely over TCP, leading to full compromise of clustered data services and downstream Fusion Middleware workloads.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60297 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60297

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used to scale stateful applications across Fusion Middleware deployments. The Core component handles cluster communication, cache operations, and object exchange between nodes over TCP. CVE-2026-60297 resides in this Core component and permits an unauthenticated remote attacker to compromise the Coherence process without any prior access.

Oracle categorizes the flaw as easily exploitable across a network. The result is full takeover of the Coherence instance, giving an attacker control of cached data, cluster membership, and any services that trust the compromised node. The Exploit Prediction Scoring System (EPSS) currently rates this vulnerability at 0.486%, and no public proof-of-concept exploit has been observed as of publication.

Root Cause

Oracle has not disclosed low-level technical details in the July 2026 advisory. Historically, remote takeover issues in Oracle Coherence Core have stemmed from unsafe handling of serialized objects and cluster protocol messages received on Coherence TCP listener ports. The advisory's characterization — unauthenticated network exploitation resulting in complete compromise — is consistent with a deserialization or protocol handling weakness in the cluster transport layer.

Attack Vector

The attack vector is network based over TCP. Any attacker able to reach a Coherence cluster port from an untrusted network segment can send a crafted request to trigger the vulnerability. No credentials, tokens, or user interaction are required. Environments that expose Coherence cluster ports beyond a hardened management VLAN, including cloud lift-and-shift deployments, face the highest exposure. Refer to the Oracle Security Alert July 2026 for authoritative guidance.

No verified public exploit code is available. Technical specifics should be sourced from the Oracle advisory rather than reconstructed.

Detection Methods for CVE-2026-60297

Indicators of Compromise

Unexpected inbound TCP connections to Coherence cluster ports (default 7574 for cluster discovery, and dynamically assigned unicast ports) from untrusted hosts.
Unusual child processes spawned by the Coherence or WebLogic JVM, such as shells, curl, wget, or scripting interpreters.
New or modified files under the Coherence installation directory, cache configuration directories, or JVM working directories.
Outbound connections from Coherence nodes to unknown IP addresses immediately after inbound cluster traffic.

Detection Strategies

Alert on Coherence JVM processes that create outbound network connections or spawn command interpreters, behavior inconsistent with a data grid workload.
Inspect Coherence and WebLogic logs for cluster join events, deserialization errors, or class loading failures originating from external IP addresses.
Correlate TCP connection telemetry against an allowlist of legitimate cluster members and management hosts.

Monitoring Recommendations

Continuously monitor exposure of Coherence ports using external attack surface tooling and internal network scans.
Baseline normal cluster traffic volume and flag deviations, particularly connections from outside the data tier subnet.
Forward JVM, operating system, and network logs from Coherence hosts to a centralized analytics platform for retention and correlation.

How to Mitigate CVE-2026-60297

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Coherence installations running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Inventory every Coherence deployment, including embedded instances shipped inside other Fusion Middleware products such as WebLogic Server.
Restrict Coherence cluster ports to trusted network segments using firewalls, security groups, or Kubernetes network policies until patching is complete.
Review Coherence and WebLogic logs for signs of prior exploitation before returning patched systems to production.

Patch Information

Oracle published the fix in the July 2026 Critical Patch Update. Administrators should download and install the applicable patch for their Coherence version from My Oracle Support. Full patch identifiers and installation prerequisites are listed in the Oracle Security Alert July 2026.

Workarounds

Isolate Coherence cluster traffic on a dedicated, non-routable VLAN or private subnet accessible only to authorized application servers.
Enforce Coherence Well-Known Addresses (WKA) and disable multicast discovery to reduce exposure of cluster membership.
Enable Coherence TLS/SSL for cluster and Extend client communication to prevent unauthenticated remote peers from joining the cluster.
Where feasible, disable Java deserialization filters or configure a strict allowlist of classes permitted for Coherence POF and Java serialization.

bash

# Example: restrict Coherence cluster ports at the host firewall (Linux, firewalld)
# Allow only trusted cluster members on TCP 7574 and Extend port 20000
sudo firewall-cmd --permanent --zone=internal --add-source=10.20.30.0/24
sudo firewall-cmd --permanent --zone=internal --add-port=7574/tcp
sudo firewall-cmd --permanent --zone=internal --add-port=20000/tcp
sudo firewall-cmd --permanent --zone=public --remove-port=7574/tcp
sudo firewall-cmd --permanent --zone=public --remove-port=20000/tcp
sudo firewall-cmd --reload