CVE-2026-60305: Oracle Coherence Privilege Escalation

CVE-2026-60305 Overview

CVE-2026-60305 is a high-severity vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. A low-privileged attacker with network access via TCP can compromise Oracle Coherence without user interaction. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, plus unauthorized read access to a subset of Coherence-accessible data. Oracle addressed this issue in the Oracle Critical Patch Update released in July 2026.

Critical Impact
An authenticated remote attacker can modify or destroy data stored in Oracle Coherence clusters, threatening the integrity of caches that back mission-critical Fusion Middleware applications.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60305 published to the National Vulnerability Database
2026-07-23 - Entry last modified in NVD

Technical Details for CVE-2026-60305

Vulnerability Analysis

The flaw resides in the Core component of Oracle Coherence, the in-memory data grid used to scale stateful applications across Fusion Middleware deployments. An attacker who already holds low-privileged credentials on the target environment can reach the Coherence service over TCP and issue requests that alter or delete cached data. The attack requires no user interaction and Oracle classifies it as easily exploitable. Impact is concentrated on integrity, with a secondary confidentiality effect against a subset of data. Availability is not directly affected, but downstream applications that trust cached state can experience corrupted business logic once poisoned entries propagate through the cluster.

Root Cause

Oracle has not published a public technical breakdown. Based on the advisory, the defect permits an authenticated network client to invoke Coherence Core operations that should require higher trust. This pattern is consistent with insufficient authorization checks on cluster or cache management operations exposed over the Coherence TCP transport.

Attack Vector

Exploitation requires TCP reachability to a Coherence node and any valid low-privileged account context recognized by the deployment. Because Coherence commonly runs on internal segments alongside WebLogic and other Fusion Middleware components, an attacker who has gained a foothold through a phished user or a compromised application server can pivot directly to the cache tier. See the Oracle Security Alert July 2026 for authoritative details.

Detection Methods for CVE-2026-60305

Indicators of Compromise

Unexpected cache mutations, deletions, or object replacements in Coherence audit logs that do not correlate with application-driven writes.
New or unusual TCP sessions targeting Coherence cluster ports from hosts outside the documented application tier.
Authentication events for low-privileged Coherence or Fusion Middleware service accounts originating from unexpected client IPs.

Detection Strategies

Enable Coherence cache access logging and forward events to a centralized analytics platform for review against baselines.
Correlate Fusion Middleware authentication logs with Coherence connection events to identify low-privileged accounts touching cluster APIs.
Alert on schema-breaking writes such as bulk deletions or type mismatches that indicate tampering rather than normal application traffic.

Monitoring Recommendations

Monitor egress and lateral TCP flows to Coherence ports and flag any source outside the approved application allowlist.
Track process execution and network behavior on WebLogic and application hosts that carry Coherence client libraries.
Review Oracle Critical Patch Update compliance dashboards weekly until all Coherence nodes are confirmed patched.

How to Mitigate CVE-2026-60305

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to every Coherence instance running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Inventory all Fusion Middleware environments that embed Coherence, including WebLogic domains and custom application deployments.
Rotate credentials for low-privileged accounts that can authenticate to Coherence services in case they were previously exposed.

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should follow the deployment guidance in the Oracle Security Alert July 2026 advisory and validate cluster health after patching each node.

Workarounds

Restrict Coherence TCP ports to a strict allowlist of application hosts using host-based and network firewalls.
Place Coherence clusters on dedicated management VLANs isolated from user-accessible segments.
Enforce strong authentication and TLS on Coherence Extend and cluster communication where supported by the deployed version.

bash

# Example: restrict Coherence cluster port to trusted application subnet
iptables -A INPUT -p tcp --dport 7574 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP