CVE-2026-60298 Overview
CVE-2026-60298 is a critical vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, specifically in the Core component. The flaw allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence and achieve full takeover of the affected system. Supported versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected. The vulnerability is classified under CWE-306: Missing Authentication for Critical Function. Oracle disclosed the issue in the Oracle Security Alert July 2026.
Critical Impact
Unauthenticated remote attackers can take over Oracle Coherence instances over TCP, impacting confidentiality, integrity, and availability.
Affected Products
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60298 published to NVD
- 2026-07-21 - Oracle releases security fix via Oracle Security Alert July 2026
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60298
Vulnerability Analysis
Oracle Coherence is a distributed in-memory data grid used in enterprise Fusion Middleware deployments for caching, clustering, and stateful data services. CVE-2026-60298 exposes the Core component to unauthenticated network attacks over TCP. An attacker with reachability to a Coherence cluster listener port can invoke privileged functionality without presenting credentials.
Oracle rates the vulnerability with confidentiality, integrity, and availability impacts set to High, meaning a successful attack results in complete takeover of the Coherence process. The EPSS score is 0.486% (percentile 39.031) as of 2026-07-23, indicating limited public exploitation activity at disclosure time, though the low attack complexity and lack of authentication increase risk.
Root Cause
The vulnerability maps to CWE-306: Missing Authentication for Critical Function. A critical operation in the Coherence Core component is reachable over TCP without verifying the identity of the requester. Because Coherence cluster members exchange serialized objects and management directives, an unauthenticated code path exposed on the network allows an attacker to submit crafted requests that the service processes with full trust.
Attack Vector
The attack requires only network access to the Coherence TCP listener. No user interaction and no prior privileges are needed. An attacker on the same network segment, or reaching an exposed Coherence port through the perimeter, can issue crafted TCP requests to the Core component. Successful exploitation compromises the Coherence instance and any data or downstream services it fronts. Oracle has not published exploit code, and no public proof-of-concept is currently available. Refer to the Oracle Security Alert July 2026 for authoritative technical details.
Detection Methods for CVE-2026-60298
Indicators of Compromise
- Unexpected inbound TCP connections to Coherence cluster ports from hosts outside the documented cluster membership.
- New or unfamiliar Java processes, child processes, or scripts spawned by the Coherence JVM.
- Anomalous serialized object payloads or oversized packets received on the Coherence Extend or cluster ports.
- Outbound network callbacks from Coherence hosts to unknown destinations following crafted TCP requests.
Detection Strategies
- Inventory all Oracle Coherence deployments and confirm versions against 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
- Correlate Coherence access logs with firewall and NetFlow data to identify unauthenticated connections to cluster ports.
- Monitor the Coherence JVM for unexpected class loading, reflection activity, or spawned OS commands.
Monitoring Recommendations
- Alert on any Coherence host initiating outbound connections that deviate from baseline cluster traffic.
- Track authentication and TLS negotiation failures on Coherence listener ports.
- Forward Coherence and WebLogic middleware logs to a centralized SIEM for retention and correlation.
How to Mitigate CVE-2026-60298
Immediate Actions Required
- Apply the July 2026 Critical Patch Update from Oracle to all Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 deployments.
- Restrict Coherence cluster and Extend ports to trusted management networks only, and block them at the perimeter.
- Audit Coherence configurations to confirm authentication and TLS are enabled for client and cluster communication.
Patch Information
Oracle addressed CVE-2026-60298 in the July 2026 Critical Patch Update. Administrators should download and apply the applicable patch for their Coherence and Fusion Middleware version from the Oracle Security Alert July 2026. Follow Oracle's documented pre-patch backup, staged rollout, and post-patch verification procedures.
Workarounds
- Place Coherence hosts behind a segmented internal network with strict allowlists limited to known cluster members.
- Enforce TLS with mutual authentication (SSLSocketProvider) on Coherence Extend and cluster protocols where supported.
- Disable or firewall Coherence management endpoints such as JMX and REST management when not required.
- Continuously monitor patch advisories from Oracle until the fixed version is deployed across all environments.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
