CVE-2026-60300: Oracle Coherence RCE Vulnerability

CVE-2026-60300 Overview

CVE-2026-60300 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated remote attacker with network access via TCP can exploit the flaw to fully compromise Oracle Coherence. Oracle assigned the issue a CVSS 3.1 base score of 9.8, reflecting impact to confidentiality, integrity, and availability.

The vulnerability affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle disclosed the flaw as part of its July 2026 Critical Patch Update advisory.

Critical Impact
Unauthenticated attackers can achieve complete takeover of Oracle Coherence clusters over the network, exposing cached data, configuration, and downstream Fusion Middleware services.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60300 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60300

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used to scale stateful applications across Fusion Middleware deployments. Nodes communicate over TCP using Coherence Extend and cluster protocols that historically rely on Java object serialization. The Core component processes these inbound messages before any application-level authentication takes place.

CVE-2026-60300 allows an unauthenticated attacker with TCP network reachability to Coherence listener ports to compromise the service. According to Oracle, the vulnerability is easily exploitable and yields full takeover of the Coherence instance. A successful attack results in loss of confidentiality, integrity, and availability across cached datasets and any applications backed by the grid.

Because Coherence often stores session state, entitlement data, and business objects, a takeover can cascade into adjacent WebLogic, SOA, and identity services that trust the grid.

Root Cause

Oracle has not published implementation-level details in the public advisory. The Core component processes untrusted network input at a stage that precedes authentication, allowing an attacker to reach vulnerable logic without credentials. Historical Coherence flaws in this class have involved unsafe deserialization of Java objects transported over the cluster and Extend protocols.

Attack Vector

The attack vector is network based. An attacker sends crafted messages to an exposed Coherence TCP listener, requires no user interaction, and needs no prior authentication. Environments that expose Coherence ports to untrusted networks, container overlays, or shared management VLANs are at the highest risk.

No verified public proof-of-concept code is available at the time of writing. See the Oracle Security Alert July 2026 for vendor-supplied technical context.

Detection Methods for CVE-2026-60300

Indicators of Compromise

Unexpected inbound TCP connections to Coherence cluster or Extend ports from outside the expected application tier.
New or unrecognized child processes spawned by the Coherence JVM, particularly shells, curl, wget, or scripting interpreters.
Unexplained outbound network connections from Coherence hosts to external IP addresses.
Coherence log entries showing deserialization errors, class-not-found exceptions, or unexpected ClassLoader activity.

Detection Strategies

Monitor Coherence JVM processes for anomalous child process creation and command execution patterns.
Inspect network flow logs for TCP connections to Coherence listener ports originating from non-application sources.
Alert on JVM stack traces referencing ObjectInputStream, ReadObject, or unusual serialization filter rejections.
Correlate authentication and file-write events on Coherence hosts against the change control baseline.

Monitoring Recommendations

Enable verbose Coherence audit logging and forward logs to a centralized SIEM for retention and correlation.
Baseline normal cluster membership traffic and alert on new peers joining unexpectedly.
Track outbound egress from Coherence hosts and block traffic to non-approved destinations.

How to Mitigate CVE-2026-60300

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Coherence installations running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Restrict TCP access to Coherence cluster and Extend ports to trusted application hosts using host firewalls, security groups, or network policies.
Audit exposure of Coherence listener ports from the internet and untrusted internal segments and remove any unintended exposure.
Review Coherence hosts for signs of prior compromise, including anomalous JVM child processes and outbound connections.

Patch Information

Oracle addressed CVE-2026-60300 in the July 2026 Critical Patch Update. Administrators should follow the fix matrix and upgrade guidance published in the Oracle Security Alert July 2026. Patch all cluster members and restart the Coherence services to load the fixed libraries.

Workarounds

Enforce network segmentation so that only authorized application servers can reach Coherence TCP ports.
Enable and tune Java serialization filters (jdk.serialFilter) and Coherence POF-only configuration to reject unexpected object classes.
Terminate any Coherence listeners exposed to untrusted networks until patches are deployed.

bash

# Example: restrict Coherence cluster port access with iptables
# Replace <APP_TIER_CIDR> and <COHERENCE_PORT> with environment-specific values
iptables -A INPUT -p tcp --dport <COHERENCE_PORT> -s <APP_TIER_CIDR> -j ACCEPT
iptables -A INPUT -p tcp --dport <COHERENCE_PORT> -j DROP