CVE-2026-60309: Oracle Coherence RCE Vulnerability

CVE-2026-60309 Overview

CVE-2026-60309 affects Oracle Coherence, a component of Oracle Fusion Middleware used for distributed in-memory data grid caching. The flaw is present in the Core component and impacts supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker with access to the physical communication segment attached to the hardware running Oracle Coherence can compromise the product. Successful exploitation results in full takeover of Oracle Coherence, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the Oracle Security Alert July 2026.

Critical Impact
An adjacent-network attacker without credentials can achieve complete takeover of Oracle Coherence deployments, exposing cached enterprise data and application state.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60309 published to NVD as part of the Oracle Critical Patch Update cycle
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60309

Vulnerability Analysis

Oracle Coherence provides a clustered data grid where nodes discover peers and replicate cached objects across the network. CVE-2026-60309 resides in the Core component that handles this inter-node communication. An attacker positioned on the same physical communication segment as a Coherence node can interact with the cluster protocol without authentication. The vendor description confirms that successful attacks lead to takeover of Oracle Coherence, meaning the attacker can control the cache grid and the application data it holds. The vulnerability carries confidentiality, integrity, and availability impacts, and Oracle rates exploitation as easy through the low attack complexity metric.

Root Cause

Oracle has not published a detailed technical breakdown of the root cause. Based on the vendor advisory, the flaw stems from insufficient validation of requests received over the Coherence cluster communication protocol on the local network segment. Coherence clusters trust adjacent participants by default, which allows an unauthenticated peer on the same segment to influence cluster state.

Attack Vector

The attack vector is Adjacent Network. Exploitation requires the attacker to reach the Layer 2 broadcast domain or physical network segment where Coherence nodes communicate. No user interaction and no privileges are required. Once on the segment, the attacker interacts with the Coherence cluster protocol to trigger the takeover condition. Given the EPSS score of 0.254%, public exploitation remains unlikely in the short term, but proximity-based attacks in flat data-center networks pose an operational risk. No public proof-of-concept code is available at this time; refer to the Oracle Security Alert July 2026 for vendor-provided details.

Detection Methods for CVE-2026-60309

Indicators of Compromise

Unexpected Coherence cluster join events from unrecognized IP or MAC addresses on the cluster segment.
Anomalous traffic on Coherence Well-Known Address (WKA) ports and multicast groups used for cluster discovery.
Unexplained changes in cache contents, cluster membership, or invocation service execution logs.

Detection Strategies

Baseline the set of nodes authorized to participate in each Coherence cluster and alert on new members joining.
Inspect Coherence server logs for cluster membership churn, authentication failures, and invocation service calls originating from unexpected hosts.
Correlate host-level process telemetry from Coherence JVMs against network flow data to identify unauthorized peers on the segment.

Monitoring Recommendations

Forward Oracle Coherence and WebLogic logs to a centralized log platform and alert on cluster join, leave, and role-change events.
Monitor east-west traffic on VLANs that host Coherence nodes for new endpoints speaking the TCMP or Coherence*Extend protocols.
Track outbound connections from Coherence JVMs to detect post-exploitation activity such as reverse shells or data exfiltration.

How to Mitigate CVE-2026-60309

Immediate Actions Required

Apply the fixes released in the Oracle Critical Patch Update referenced in the Oracle Security Alert July 2026 to all affected Coherence versions.
Inventory every deployment running Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and prioritize patching internet-adjacent and shared-tenant environments.
Restrict Layer 2 access to Coherence cluster segments to authorized application and infrastructure hosts only.

Patch Information

Oracle addressed CVE-2026-60309 in the July 2026 Critical Patch Update. Administrators should download and deploy the patches for their specific Coherence release from My Oracle Support as directed by the Oracle Security Alert July 2026. Coordinate patch application with WebLogic Server updates when Coherence is embedded in Fusion Middleware deployments.

Workarounds

Isolate Coherence clusters on dedicated VLANs or private subnets with strict access control lists limiting membership to known nodes.
Configure Coherence Well-Known Addresses (WKA) instead of multicast discovery to reduce the exposure of cluster join operations.
Enable Coherence cluster authentication and TLS for cluster and Extend traffic to raise the bar for adjacent attackers until patches are deployed.

bash

# Configuration example: restrict Coherence cluster to specific WKA nodes and enable TLS
# Set on JVM startup for each Coherence node
-Dcoherence.wka=10.10.20.11,10.10.20.12,10.10.20.13
-Dcoherence.clusterport=7574
-Dcoherence.socketprovider=ssl
-Dcoherence.security.keystore=/etc/coherence/identity.jks
-Dcoherence.security.password=changeit