CVE-2026-60299 Overview
CVE-2026-60299 is a critical vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, specifically within the Core component. The flaw allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence and achieve full takeover of the affected instance. Oracle disclosed the issue in its July 2026 Critical Patch Update. Supported versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected. The vulnerability impacts confidentiality, integrity, and availability, making Coherence deployments exposed to untrusted networks a high-priority remediation target.
Critical Impact
Unauthenticated attackers with TCP network access can take over Oracle Coherence instances, gaining full control over the in-memory data grid and its cached application data.
Affected Products
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0
- Oracle Coherence 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60299 published to the National Vulnerability Database (NVD)
- 2026-07-23 - Last updated in NVD database
- Oracle addressed the vulnerability in the Oracle Critical Patch Update July 2026
Technical Details for CVE-2026-60299
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used to scale Fusion Middleware and custom Java applications. The Core component provides clustering, cache management, and inter-node communication over TCP. CVE-2026-60299 resides in this Core component and is reachable without authentication over the network.
Oracle's advisory classifies the flaw as easily exploitable, requiring no privileges and no user interaction. Successful exploitation results in complete takeover of the Coherence instance, exposing cached application data and providing a foothold in the middleware tier. Attackers who reach a Coherence listener port can subvert the grid, tamper with cached objects, or disrupt clustered services relying on it.
Root Cause
Oracle has not published the underlying technical root cause. Coherence has a history of unsafe deserialization issues in its cluster protocol, where TCP-reachable services process attacker-controlled serialized Java objects. The advisory's description of unauthenticated TCP compromise resulting in full takeover is consistent with this class of issue, but the specific weakness is not disclosed in the referenced Oracle bulletin.
Attack Vector
The attack vector is Network with low complexity. An attacker only needs TCP reachability to a Coherence cluster port, typically exposed inside application tiers but sometimes accessible from broader network segments due to misconfiguration. No credentials, tokens, or user interaction are required. Because Coherence often runs alongside WebLogic and other Fusion Middleware components, a successful compromise can enable lateral movement into adjacent Java application servers.
No verified public proof-of-concept exploit code is available at the time of writing. See the Oracle Critical Patch Update July 2026 for vendor guidance.
Detection Methods for CVE-2026-60299
Indicators of Compromise
- Unexpected inbound TCP connections to Oracle Coherence cluster ports from hosts outside the application tier.
- Coherence JVM processes spawning child processes such as shells, cmd.exe, powershell.exe, or scripting interpreters.
- New or modified files under Coherence installation directories, temporary paths, or WebLogic domain directories.
- Outbound connections from Coherence nodes to unfamiliar external hosts, indicating possible reverse shells or staging.
Detection Strategies
- Inventory all Oracle Coherence instances and identify versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
- Monitor Java process behavior on Coherence hosts for anomalous child process creation and unexpected class loading.
- Correlate network telemetry with process telemetry to identify TCP flows to Coherence ports followed by suspicious execution.
- Review Coherence and WebLogic logs for unexpected node join events, deserialization errors, or repeated malformed cluster packets.
Monitoring Recommendations
- Baseline expected Coherence cluster peers and alert on connections from any source outside that allowlist.
- Track EPSS movement for CVE-2026-60299 (currently 0.486%, percentile 39.03) to prioritize as exploitation likelihood shifts.
- Enable verbose auditing on middleware hosts, forwarding to a central analytics platform for retention and correlation.
How to Mitigate CVE-2026-60299
Immediate Actions Required
- Apply the fixes from the Oracle Critical Patch Update July 2026 to all Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 deployments.
- Restrict TCP access to Coherence cluster ports so only trusted middleware peers can reach them.
- Audit perimeter and internal firewall rules to confirm Coherence listeners are not reachable from user networks or the internet.
- Rotate credentials and secrets cached or accessible through Coherence if compromise is suspected.
Patch Information
Oracle published patches for CVE-2026-60299 in the July 2026 Critical Patch Update. Administrators should follow the version-specific patch guidance in the advisory and validate the fix in non-production environments before rolling out to production Fusion Middleware clusters.
Workarounds
- Place Coherence cluster traffic on an isolated management VLAN or private subnet accessible only to authorized middleware nodes.
- Enforce network segmentation between application servers and Coherence tiers using host-based firewalls and cloud security groups.
- Where supported, enable Coherence's authentication and TLS options for cluster and Extend client communication to reduce exposure until patches are applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
