CVE-2026-60236 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Coherence, a distributed caching and processing platform that forms part of Oracle Fusion Middleware. The affected versions span across multiple release lines including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, indicating a widespread exposure across the product lifecycle. The vulnerability is classified as easily exploitable, meaning that attackers with minimal technical expertise can leverage it without requiring specialized skills or access privileges. This characteristic significantly amplifies the risk profile as it reduces the barrier to successful exploitation.
The technical flaw manifests as a security weakness in the Core component of Oracle Coherence that operates at the TCP network level. The vulnerability allows unauthenticated attackers to establish network connections and compromise the system without requiring valid credentials or prior access rights. This type of attack vector is particularly dangerous because it eliminates authentication requirements entirely, making it possible for external threat actors to target the system from any network location. The CVSS 3.1 base score of 9.8 reflects the severity of this vulnerability, with high impact scores across all three core security principles: confidentiality, integrity, and availability.
The operational impact of successful exploitation is severe and potentially catastrophic for organizations relying on Oracle Coherence for their distributed computing needs. A successful attack results in complete takeover of the Oracle Coherence system, which could lead to unauthorized data access, modification of critical application data, service disruption, and potential lateral movement within the network infrastructure. Given that Coherence systems often serve as foundational components for enterprise applications, compromising these systems can cascade into broader business continuity issues and data breach scenarios.
From a cybersecurity framework perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and represents a critical weakness in the authorization mechanisms of the Oracle Coherence platform. The attack pattern follows typical network-based exploitation techniques that map to ATT&CK tactics such as T1190 (Exploit Public-Facing Application) and T1071.004 (Application Layer Protocol: DNS). Organizations should prioritize immediate patch management and network segmentation strategies to mitigate exposure. Additional defensive measures including firewall rules restricting access to Coherence ports, network monitoring for anomalous TCP connections, and regular vulnerability assessments are essential components of a comprehensive mitigation strategy. The vulnerability also highlights the importance of maintaining up-to-date security patches across all Oracle Fusion Middleware components to prevent similar exposure scenarios in the future.