CVE-2026-60308: Oracle Coherence RCE Vulnerability

CVE-2026-60308 Overview

CVE-2026-60308 is a critical vulnerability in the Core component of Oracle Coherence, part of the Oracle Fusion Middleware suite. An unauthenticated attacker with network access over HTTP can compromise Oracle Coherence and gain full takeover of the affected system. The flaw affects supported versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Because exploitation requires no authentication and no user interaction, any Coherence instance reachable over HTTP is at risk of remote compromise resulting in loss of confidentiality, integrity, and availability.

Critical Impact
Unauthenticated network attackers can achieve complete takeover of Oracle Coherence servers, exposing cached enterprise data and downstream Fusion Middleware services.

Affected Products

Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60308 published to NVD as part of the Oracle Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60308

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used by Fusion Middleware deployments for distributed caching and session state. The vulnerability resides in the Core component and is reachable over HTTP without authentication. According to Oracle's advisory, successful exploitation results in takeover of Oracle Coherence, meaning the attacker gains control equivalent to the service account running the grid.

The scope is unchanged, but the impact extends across confidentiality, integrity, and availability. An attacker who compromises a Coherence node can read cached credentials and session tokens, tamper with cached application state, and disrupt clustered services. Because Coherence typically operates inside trusted middleware tiers, a compromised node can be leveraged as a pivot into database and application servers.

Root Cause

Oracle has not published detailed root-cause information beyond the Core component designation and network HTTP attack vector. Historical Coherence vulnerabilities with similar characteristics have stemmed from insecure deserialization of untrusted objects in T3, IIOP, or HTTP-based management interfaces. Refer to the Oracle Security Alert July 2026 for authoritative technical details.

Attack Vector

The attack vector is network-based over HTTP with low attack complexity. The attacker requires no privileges and no user interaction. An exposed Coherence management or cluster HTTP endpoint reachable from an untrusted network is sufficient for exploitation. The EPSS score of 0.395% reflects that no public exploit is yet indexed, but the profile makes weaponization straightforward once technical details emerge.

No verified public proof-of-concept code is available. Consult the Oracle Security Alert July 2026 for vendor-provided technical guidance.

Detection Methods for CVE-2026-60308

Indicators of Compromise

Unexpected outbound connections from Coherence JVM processes to unfamiliar IP addresses or ports.
New or modified Java classes, JAR files, or scripts under Coherence installation directories.
Anomalous child processes spawned by the Coherence server process, particularly shells, curl, wget, or interpreters.
Unexplained cluster membership changes or new Coherence nodes joining from external networks.

Detection Strategies

Monitor Coherence HTTP listener logs for unusual POST requests, oversized payloads, or serialized Java object markers.
Alert on process lineage where the Coherence JVM spawns operating system commands or network utilities.
Correlate authentication events on downstream databases and middleware with source IPs of Coherence hosts to identify lateral movement.

Monitoring Recommendations

Enable verbose access logging on all Coherence HTTP endpoints and forward logs to a centralized SIEM.
Baseline normal Coherence cluster traffic and alert on deviations in port usage, peer counts, and payload sizes.
Track file integrity on Coherence binaries and configuration files, including tangosol-coherence-override.xml.

How to Mitigate CVE-2026-60308

Immediate Actions Required

Apply the fixes from the Oracle July 2026 Critical Patch Update to all affected Coherence installations immediately.
Inventory every Coherence deployment running 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and prioritize internet-exposed instances.
Restrict network access to Coherence HTTP and cluster ports so they are reachable only from trusted management subnets.
Rotate credentials, tokens, and keys cached in Coherence if compromise cannot be ruled out.

Patch Information

Oracle addressed CVE-2026-60308 in the July 2026 Critical Patch Update. Patch bundles for Oracle Coherence 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are available through My Oracle Support. Review the Oracle Security Alert July 2026 for the specific patch identifiers and installation prerequisites.

Workarounds

Place Coherence HTTP endpoints behind an authenticated reverse proxy or WAF that rejects unauthenticated requests to management URIs.
Enforce strict allow-lists at the network firewall so only application tier hosts can reach Coherence services.
Disable any unused HTTP management or REST endpoints exposed by Coherence until patching completes.

bash

# Example iptables restriction limiting Coherence HTTP access to an app-tier subnet
iptables -A INPUT -p tcp --dport 8080 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP