CVE-2026-60306: Oracle Coherence RCE Vulnerability

CVE-2026-60306 Overview

CVE-2026-60306 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via TCP can compromise the affected system and achieve full takeover. The flaw affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can achieve complete takeover of Oracle Coherence with high impact to confidentiality, integrity, and availability.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60306 published to NVD
2026-07-23 - Last updated in NVD database
July 2026 - Oracle releases fix in Oracle Critical Patch Update

Technical Details for CVE-2026-60306

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle Coherence, an in-memory data grid used across Oracle Fusion Middleware deployments. Oracle characterizes the flaw as easily exploitable over TCP without prior authentication or user interaction. Successful exploitation results in full takeover of the Coherence instance, giving attackers control over confidentiality, integrity, and availability of the cluster.

Oracle Coherence historically exposes cluster communication and management endpoints over TCP. Vulnerabilities in this component have previously involved insecure deserialization of Java objects transmitted between cluster members. Oracle has not published component-level technical details beyond the advisory, and no CWE identifier is listed at the time of writing.

Root Cause

Oracle has not disclosed the specific root cause. The advisory language — network-reachable TCP service, no privileges, no user interaction, and complete system takeover — is consistent with classes of flaws such as insecure deserialization or protocol-level authentication bypass in cluster communication paths. Consult the Oracle Critical Patch Update for authoritative technical details.

Attack Vector

An attacker sends crafted TCP traffic to a Coherence cluster port reachable from their network position. No credentials or user interaction are required. Once the payload is processed, the attacker gains control equivalent to the Coherence process, which typically runs with access to cached application data, configuration, and downstream services. Because Coherence is often deployed on internal networks behind application tiers, this flaw is particularly relevant for lateral movement scenarios.

No verified proof-of-concept code has been published. The EPSS score is 0.395% at the 32nd percentile as of 2026-07-23, indicating limited observed exploitation activity at disclosure time.

Detection Methods for CVE-2026-60306

Indicators of Compromise

Unexpected inbound TCP connections to Coherence cluster ports (commonly 7574 for cluster discovery and dynamically allocated Extend or TCMP ports) from untrusted sources.
Spawning of child processes (shells, curl, wget, powershell) from the Coherence Java process.
New or modified JAR files, class files, or configuration under Coherence installation directories.
Outbound network connections initiated by the Coherence JVM to unfamiliar external hosts.

Detection Strategies

Monitor Coherence JVM process ancestry and flag any non-Java child processes as high severity.
Inspect Coherence and application server logs for deserialization errors, class-not-found exceptions, or unusual ClassLoader activity.
Baseline expected cluster peers and alert on TCMP or Extend connections from IP addresses outside the approved cluster membership.

Monitoring Recommendations

Enable verbose logging on Coherence cluster and Extend listeners and forward logs to a central SIEM for correlation.
Track file integrity on coherence.jar, cache configuration XML, and any override files.
Alert on Coherence hosts initiating outbound connections to non-approved destinations or making DNS lookups for uncommon domains.

How to Mitigate CVE-2026-60306

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Coherence versions without delay.
Inventory every deployment of Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 across production and non-production estates.
Restrict TCP access to Coherence cluster and Extend ports to explicit allow-lists of trusted hosts.
Review recent Coherence host telemetry for signs of exploitation prior to patch deployment.

Patch Information

Oracle addresses CVE-2026-60306 in the Oracle Critical Patch Update - July 2026. Administrators should follow Oracle's advisory to identify the exact patch bundle for each Coherence release train and apply it in accordance with Oracle patching procedures for Fusion Middleware.

Workarounds

Place Coherence clusters on isolated network segments unreachable from user, DMZ, or internet-facing networks.
Enforce TLS and mutual authentication on cluster and Extend communications where supported by the Coherence version in use.
Configure host-based firewalls to permit Coherence TCP ports only between known cluster members and approved clients.
Run the Coherence JVM under a least-privilege service account with restricted filesystem and outbound network access.

bash

# Example: restrict Coherence cluster port 7574 to trusted subnet using iptables
iptables -A INPUT -p tcp --dport 7574 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP

# Example: restrict Coherence Extend proxy port (adjust to your configuration)
iptables -A INPUT -p tcp --dport 9099 -s 10.10.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP