CVE-2026-60221 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability under discussion represents a critical security flaw in Oracle Coherence, a distributed caching and processing platform within Oracle Fusion Middleware suite. This issue affects multiple versions including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, indicating a widespread impact across the product lifecycle. The vulnerability resides in the Core component of Oracle Coherence, which serves as the fundamental infrastructure for distributed data management and processing operations within enterprise environments.
The technical nature of this flaw allows for unauthenticated remote exploitation through TCP network connections, making it particularly dangerous as it requires no prior authentication credentials or privileged access to initiate attacks. This characteristic aligns with CWE-284 Access Control Issues, where insufficient access controls permit unauthorized users to gain system privileges. The vulnerability's exploitability is rated as easily exploitable due to the minimal prerequisites required for successful attack execution, making it a prime target for automated exploitation tools and malicious actors seeking to compromise enterprise infrastructure.
The operational impact of this vulnerability extends beyond simple data compromise, as successful exploitation can result in complete takeover of Oracle Coherence systems. This level of compromise directly affects all three core security principles defined by the CVSS 3.1 scoring system with high impacts across confidentiality, integrity, and availability. Attackers could potentially gain full control over distributed caching operations, manipulate or steal sensitive data stored in memory caches, disrupt business operations through availability degradation, and modify critical application data that depends on Coherence for its distributed processing capabilities.
The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) clearly demonstrates the severity with network access required, low attack complexity, no privileges needed, and universal scope affecting the entire system. This vulnerability maps to several ATT&CK techniques including T1046 Network Service Scanning and T1059 Command and Scripting Interpreter, as attackers would likely first scan for vulnerable instances before attempting exploitation. Organizations running affected versions face significant risk of data breaches, service disruption, and potential lateral movement within their networks, as Oracle Coherence systems often serve as critical infrastructure components for enterprise applications.
Effective mitigation strategies should include immediate patching of all affected Oracle Coherence versions through official Oracle security updates, network segmentation to limit exposure of Coherence instances to untrusted networks, and implementation of firewall rules that restrict TCP access to necessary administrative hosts only. Additionally, organizations should consider disabling unnecessary services, implementing network monitoring for unusual TCP connection patterns, and conducting thorough vulnerability assessments to identify any potentially compromised systems within their infrastructure. The remediation approach must also address the underlying architectural concerns that allow this type of unauthenticated remote code execution in distributed systems, aligning with industry best practices for securing enterprise middleware components against similar attack vectors.