CVE-2026-60217 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Coherence, a distributed caching and processing platform that forms part of Oracle Fusion Middleware, specifically affecting core components of the system. The affected versions span across multiple release lines including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, indicating a widespread issue that impacts the fundamental architecture of Oracle's distributed computing framework. The vulnerability's classification as easily exploitable means that threat actors can leverage it without requiring specialized skills or privileged access, making it particularly dangerous in production environments where such systems are often exposed to network traffic.
The technical flaw manifests through an unauthenticated attack vector that operates over TCP connections, allowing remote adversaries to compromise the Oracle Coherence instance without prior authentication. This represents a critical weakness in the system's security model, as it bypasses traditional authentication mechanisms that should normally protect distributed computing resources. The vulnerability's impact extends beyond the immediate Oracle Coherence component, creating a scope change that can significantly affect additional products within the Oracle ecosystem, suggesting that compromise of this service could lead to broader system infiltration or data exposure across interconnected Oracle applications.
From an operational perspective, successful exploitation results in complete takeover of the Oracle Coherence service, which fundamentally undermines the integrity and availability of distributed data processing capabilities. The CVSS 3.1 base score of 10.0 reflects the severity of this vulnerability, with high impacts across all three core security tenets: confidentiality, integrity, and availability. This scoring indicates that attackers can potentially access sensitive data stored in distributed caches, modify or corrupt system state information, and render the caching service unavailable to legitimate users. The network-based attack vector (AV:N) combined with low access complexity (AC:L) means that this vulnerability is particularly dangerous as it can be exploited from any location on the internet without requiring physical access or specialized knowledge.
Organizations should implement immediate mitigations including network segmentation to restrict access to Oracle Coherence ports, deployment of firewalls to block unauthorized TCP connections, and application of Oracle's security patches. The vulnerability aligns with CWE-284 (Improper Access Control) and represents a significant concern under the ATT&CK framework's privilege escalation and initial access categories. Given that Oracle Coherence often serves as a foundation for enterprise applications, this vulnerability creates cascading risks that could impact database systems, web applications, and other services that depend on distributed caching mechanisms. Security teams must prioritize patch management processes and consider implementing monitoring solutions to detect unauthorized access attempts to Coherence instances, particularly in environments where such services are exposed to untrusted networks.