CVE-2026-60307 Overview
CVE-2026-60307 is an information disclosure vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. A low-privileged attacker with network access via HTTP can exploit this flaw to gain unauthorized read access to a subset of Oracle Coherence data. The vulnerability affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle addressed the issue in its July 2026 Critical Patch Update.
Critical Impact
Authenticated remote attackers can read a subset of Oracle Coherence data over HTTP without user interaction, exposing sensitive cached information.
Affected Products
- Oracle Coherence 12.2.1.4.0 and 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
- Oracle Fusion Middleware deployments embedding the affected Coherence Core component
Discovery Timeline
- 2026-07-21 - CVE-2026-60307 published to the National Vulnerability Database
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60307
Vulnerability Analysis
The flaw resides in the Core component of Oracle Coherence, the in-memory data grid used by Oracle Fusion Middleware for distributed caching and stateful application scaling. An attacker with valid low-privilege credentials can send crafted HTTP requests to a Coherence endpoint and retrieve cached data that should be restricted. The exposure is limited to confidentiality — no integrity or availability impact is reported. Because Coherence commonly stores session state, application caches, and business objects, disclosed data may include operational or customer information that supports follow-on attacks.
Root Cause
Oracle's advisory categorizes the issue as easily exploitable over the network by an authenticated actor. The disclosure characteristic maps to an information exposure class weakness in the Core component's HTTP-facing data access path. Oracle has not published lower-level technical detail beyond the July 2026 Critical Patch Update entry.
Attack Vector
Exploitation requires network reachability to the Coherence HTTP interface and any valid low-privilege account. No user interaction is needed and the attack complexity is low. Attackers targeting internet-exposed or lateral-accessible Fusion Middleware environments can chain this read primitive with other weaknesses to expand reconnaissance and access. Refer to the Oracle Critical Patch Update Advisory - July 2026 for authoritative technical details.
Detection Methods for CVE-2026-60307
Indicators of Compromise
- Unusual HTTP request volumes to Coherence management or data access endpoints originating from low-privilege service accounts.
- Authentication events for Coherence users followed by anomalous data retrieval patterns outside normal application flows.
- Access to cache names, keys, or partitions that are not part of the account's documented application scope.
Detection Strategies
- Enable audit logging on Oracle Coherence and Fusion Middleware HTTP listeners and forward events to a centralized SIEM for correlation.
- Baseline normal query patterns per service account and alert on deviations in cache access breadth or frequency.
- Inspect WebLogic and Coherence access logs for repeated GET requests targeting cache resources by accounts that historically do not read them.
Monitoring Recommendations
- Monitor egress traffic from Coherence hosts for unexpected data volumes that could indicate bulk cache extraction.
- Track privileged and low-privileged account usage against Coherence endpoints and flag off-hours activity.
- Correlate Coherence access events with identity provider logs to spot credential reuse from unusual source IPs.
How to Mitigate CVE-2026-60307
Immediate Actions Required
- Apply the Oracle July 2026 Critical Patch Update to all affected Coherence deployments.
- Inventory Oracle Fusion Middleware instances and confirm the running Coherence version against 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
- Rotate credentials for any low-privilege service account that could reach Coherence HTTP endpoints if compromise is suspected.
Patch Information
Oracle released fixes for CVE-2026-60307 as part of the Oracle Critical Patch Update Advisory - July 2026. Administrators should follow the patch matrix for their specific Fusion Middleware release and validate the update in a non-production environment before rollout.
Workarounds
- Restrict network access to Coherence HTTP endpoints using firewall rules or service mesh policies until patching completes.
- Enforce least-privilege on Coherence roles and remove unnecessary low-privilege accounts that can authenticate to the Core component.
- Place Coherence management interfaces behind a reverse proxy that requires additional authentication and IP allow-listing.
# Configuration example: restrict Coherence HTTP listener to internal management subnet
# iptables example - allow only trusted admin subnet to reach Coherence HTTP port
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
