CVE-2026-60302 Overview
CVE-2026-60302 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence and achieve full product takeover. Oracle disclosed the issue in the July 2026 Critical Patch Update. Affected supported versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Successful exploitation impacts confidentiality, integrity, and availability of the targeted service.
Critical Impact
Unauthenticated network attackers can take over Oracle Coherence instances, exposing cached data, cluster configurations, and application state across affected Fusion Middleware deployments.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60302 published to NVD as part of the Oracle July 2026 Critical Patch Update
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60302
Vulnerability Analysis
Oracle Coherence provides an in-memory data grid used to scale Fusion Middleware applications. The Core component handles cluster membership, service discovery, and data distribution over TCP. CVE-2026-60302 exposes this TCP-accessible surface to unauthenticated attackers on the network. Oracle rates the issue as easily exploitable and describes the outcome as full product takeover, aligning with prior Coherence flaws rooted in unsafe processing of cluster traffic. The vulnerability affects both integrity and availability, meaning attackers can manipulate cached data and disrupt clustered services relying on Coherence.
Root Cause
Oracle has not published a public technical breakdown beyond the Critical Patch Update advisory. The advisory identifies the Core component and confirms that no authentication or user interaction is required. Historically, comparable Coherence issues have originated from unsafe handling of cluster protocol messages, including deserialization of attacker-supplied objects transmitted over TCP.
Attack Vector
Exploitation requires only TCP reachability to the Coherence cluster port. An attacker sends crafted network traffic to a listening Coherence node, triggering the flawed logic in the Core component. Because no privileges or user interaction are needed, exposed Coherence deployments — particularly those with cluster ports reachable beyond trusted network segments — are directly at risk. See the Oracle Critical Patch Update - July 2026 for the authoritative advisory.
No verified proof-of-concept code is publicly available at the time of writing. Refer to the Oracle advisory for technical guidance rather than speculative exploit samples.
Detection Methods for CVE-2026-60302
Indicators of Compromise
- Unexpected inbound TCP connections to Coherence cluster ports (default 7574 for cluster discovery and dynamically assigned unicast ports) from non-cluster hosts.
- New or unexpected Java processes, class loads, or child processes spawned by the Coherence JVM.
- Anomalous outbound connections from Coherence servers, indicating post-exploitation command and control.
Detection Strategies
- Inventory all Oracle Coherence instances and compare installed versions against the patched builds listed in the Oracle July 2026 CPU.
- Monitor Coherence JVM logs for unusual deserialization errors, class resolution failures, or repeated cluster join attempts from unknown members.
- Alert on process lineage where the Coherence JVM spawns shell interpreters, scripting runtimes, or network utilities.
Monitoring Recommendations
- Capture network flow data for Coherence cluster ports and baseline expected peers to surface unauthorized connections.
- Forward JVM, application server, and host telemetry to a centralized analytics platform for correlation across the Fusion Middleware stack.
- Track file writes and privileged operations performed by the account running Coherence to identify post-exploitation activity.
How to Mitigate CVE-2026-60302
Immediate Actions Required
- Apply the fixes from the Oracle Critical Patch Update - July 2026 to all affected Coherence versions.
- Restrict TCP access to Coherence cluster ports so that only trusted cluster members can connect.
- Audit exposure by scanning perimeter and internal networks for Coherence ports reachable from untrusted zones.
Patch Information
Oracle addressed CVE-2026-60302 in the July 2026 Critical Patch Update. Administrators must apply the updates that correspond to their installed Coherence version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0). Consult the Oracle Critical Patch Update - July 2026 advisory for exact patch identifiers and installation prerequisites.
Workarounds
- Place Coherence clusters on isolated network segments with firewall rules that deny external access to cluster and unicast ports.
- Enforce Coherence authorized-hosts configuration and TLS between cluster members to reduce the exposed attack surface until patching completes.
- Disable or block any Coherence extend proxy listeners that are not actively required by applications.
# Configuration example: restrict Coherence cluster ports at the host firewall
# Replace <trusted_subnet> with the CIDR of your Coherence cluster members
iptables -A INPUT -p tcp --dport 7574 -s <trusted_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
