CVE-2026-60226 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability under discussion affects Oracle Coherence, a distributed caching and processing platform within Oracle Fusion Middleware that is widely deployed in enterprise environments for high-performance data management and application scalability. This particular flaw resides in the Core component of Oracle Coherence and impacts multiple supported versions including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.0.0.0, representing a significant portion of the product's deployment landscape across different release cycles.
The technical nature of this vulnerability stems from insufficient authentication mechanisms within the Oracle Coherence service listening on TCP ports, creating an easily exploitable entry point for malicious actors. The flaw allows unauthenticated attackers to establish network connections and potentially execute arbitrary code or commands against the target system. This type of vulnerability typically manifests as a failure in access control implementation where the system does not adequately verify the identity of connecting entities before granting service access. According to CWE classification, this vulnerability aligns with CWE-287 which addresses improper authentication issues within software systems.
The operational impact of this vulnerability is severe and potentially catastrophic for affected organizations. A successful exploitation can result in complete compromise of the Oracle Coherence instance, enabling attackers to gain full control over the distributed caching infrastructure. This takeover capability extends beyond simple unauthorized access to include potential data exfiltration, modification of cached data, service disruption, and as a stepping stone for further lateral movement within enterprise networks where Coherence clusters often serve as critical components in application architectures. The CVSS 3.1 score of 9.8 reflects the high severity with complete impacts across confidentiality, integrity, and availability domains.
From an attack perspective, this vulnerability fits squarely within ATT&CK framework's privilege escalation and defense evasion techniques, specifically mapping to T1078 for valid accounts and T1566 for phishing. The network-based attack vector requires minimal technical sophistication from threat actors since no authentication credentials are required for initial access. Organizations utilizing Oracle Coherence in production environments face significant risk exposure as this vulnerability can be exploited remotely without requiring any prior login credentials or specialized tools beyond basic network connectivity. The combination of high CVSS score, lack of authentication requirements, and the critical nature of Coherence services in enterprise architectures makes this vulnerability particularly dangerous.
Mitigation strategies should prioritize immediate patching of affected versions through Oracle's security updates and advisory notifications. Network segmentation and firewall rules should be implemented to restrict access to Oracle Coherence TCP ports from trusted networks only, while disabling unnecessary services and ports where possible. Organizations should also implement monitoring solutions to detect unusual network activity patterns that might indicate exploitation attempts. Additional defensive measures include regular vulnerability assessments, maintaining updated threat intelligence feeds, and conducting security awareness training for system administrators who manage these critical infrastructure components. The remediation process must also include comprehensive testing of patches in non-production environments before deployment to ensure operational stability while addressing the identified security weakness.