CVE-2026-60197 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
Oracle Coherence represents a distributed caching and processing platform within Oracle Fusion Middleware that facilitates high-performance data management across distributed systems. This vulnerability exists within the core component of Oracle Coherence and affects multiple supported versions including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw manifests as a critical security weakness that allows unauthenticated attackers to exploit network connectivity through TCP protocols to gain control over the Oracle Coherence instance.
The technical nature of this vulnerability stems from insufficient authentication mechanisms within the Oracle Coherence service implementation, creating an attack surface that can be leveraged without requiring prior credentials or privileged access. This represents a fundamental failure in the principle of least privilege and authentication controls, where the system fails to properly validate incoming connections before granting access to core functionality. The CVSS 3.1 score of 9.8 indicates the severity of this flaw across all three impact vectors - confidentiality, integrity, and availability - suggesting that successful exploitation could result in complete system compromise.
Attackers can exploit this vulnerability by establishing TCP connections to the affected Oracle Coherence instances without authentication requirements, potentially leading to full system takeover. This allows adversaries to execute arbitrary code, modify data, disrupt services, and gain access to sensitive information stored within the distributed cache. The impact extends beyond individual system compromise as Oracle Coherence typically serves as a critical component in enterprise architectures, making this vulnerability particularly dangerous for organizations relying on distributed computing environments.
The operational consequences of this vulnerability are severe as it enables attackers to perform reconnaissance, lateral movement, and persistent access within network environments where Oracle Coherence is deployed. Organizations may face data breaches, service disruptions, and potential regulatory compliance violations depending on the nature of information processed through these systems. The ease of exploitation means that automated attack tools could quickly identify and exploit vulnerable instances across networks, amplifying the potential damage.
Security mitigations for this vulnerability should include immediate patching of affected Oracle Coherence versions to address the authentication bypass flaw. Network segmentation strategies should be implemented to restrict access to Oracle Coherence services, particularly limiting TCP connectivity to trusted administrative networks only. Organizations should also consider implementing additional monitoring and detection capabilities to identify unauthorized access attempts or anomalous network activity related to Coherence services. The vulnerability aligns with CWE-287 which addresses improper authentication issues, and represents a significant concern under ATT&CK framework category T1190 for exploit public-facing applications, highlighting the need for comprehensive security posture improvements across enterprise environments using Oracle Fusion Middleware products.