CVE-2026-60218 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Coherence, a distributed caching and processing platform that forms part of Oracle Fusion Middleware. The flaw resides in the Core component of this middleware solution and affects multiple version lines including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability classification as easily exploitable indicates that attackers with minimal privileges and network connectivity can leverage this weakness to compromise the affected system. This represents a significant security risk given Oracle Coherence's role in enterprise distributed computing environments where it manages critical data caching and processing functions across multiple nodes.
The technical nature of this vulnerability allows an attacker with low privilege levels and TCP network access to execute attacks that can result in complete takeover of the Oracle Coherence service. The CVSS 3.1 base score of 8.8 reflects the high severity impact across all three security properties - confidentiality, integrity, and availability. The attack vector is classified as network-based (AV:N) with low attack complexity (AC:L) and requires only low privileges (PR:L), making it particularly dangerous as it can be exploited by attackers who may not have elevated system access. The lack of user interaction requirement (UI:N) further increases the exploitability factor, while the unspecified scope (S:U) indicates that the vulnerability affects the target system without impacting other systems within the same security domain.
The operational impact of this vulnerability extends beyond simple service disruption to potentially enable full system compromise and data exfiltration. Oracle Coherence typically operates as a distributed system managing shared memory spaces and coordinating between multiple application servers, making it a critical component in enterprise architectures. Successful exploitation could allow attackers to manipulate cached data, disrupt distributed processing workflows, access sensitive information stored in the cache, or even use the compromised system as a pivot point for attacking other network resources within the enterprise perimeter. This vulnerability directly impacts the integrity and availability of business-critical applications that depend on Oracle Coherence for their distributed computing requirements.
Organizations should prioritize immediate mitigation through official Oracle security patches and updates released for the affected versions. Network segmentation and firewall rules should be implemented to restrict unnecessary TCP access to Oracle Coherence ports, while monitoring systems should be enhanced to detect anomalous network traffic patterns associated with exploitation attempts. The vulnerability aligns with CWE-20 (Improper Input Validation) and CWE-284 (Improper Access Control) categories, representing weak input sanitization and inadequate privilege controls within the distributed caching system. From an ATT&CK framework perspective, this vulnerability maps to T1190 (Exploit Public-Facing Application) and potentially T1071.004 (Application Layer Protocol: DNS) if exploitation involves domain name resolution manipulation. Regular security assessments and vulnerability scanning should be conducted to identify any potential unauthorized access or compromise of the distributed caching infrastructure, while incident response procedures should be updated to address potential exploitation scenarios involving Oracle Coherence system takeovers.