CVE-2026-60239 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Coherence accessible data as well as unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability identified in Oracle Coherence within Oracle Fusion Middleware represents a critical security weakness that undermines the integrity and confidentiality of distributed caching systems. This flaw exists in the Core component of Oracle Coherence and affects multiple version streams including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, indicating a widespread impact across the product lifecycle. The vulnerability's classification as easily exploitable suggests that attackers with minimal privileges and network access can leverage this weakness without requiring specialized tools or extensive technical knowledge.
The technical nature of this vulnerability stems from insufficient access controls within the HTTP interface of Oracle Coherence, allowing unauthorized users to perform administrative operations against the system. This represents a fundamental breakdown in the principle of least privilege, where low-privileged attackers can escalate their privileges to gain comprehensive access to the caching infrastructure. The CVSS 3.1 score of 9.6 reflects the severity of potential impacts, with high confidentiality and integrity implications that could result in complete data compromise across affected systems.
The operational impact extends beyond the immediate Oracle Coherence environment due to the scope change aspect of this vulnerability, meaning that successful exploitation can affect additional products within the broader Oracle Fusion Middleware ecosystem. This cascading effect demonstrates how vulnerabilities in core components can create ripple effects throughout enterprise infrastructure, potentially compromising multiple interconnected systems that rely on Coherence for data synchronization and caching services.
Attackers exploiting this vulnerability can achieve unauthorized creation, deletion, or modification of critical data within Oracle Coherence, effectively allowing them to manipulate the underlying data store with complete administrative privileges. The potential for unauthorized access to all accessible data represents a severe threat to data integrity and confidentiality, particularly in enterprise environments where Coherence often manages sensitive business-critical information. This vulnerability directly maps to CWE-284 (Improper Access Control) and aligns with ATT&CK techniques involving privilege escalation and data manipulation.
Organizations should implement immediate mitigations including network segmentation to restrict HTTP access to Oracle Coherence components, deployment of web application firewalls to filter malicious requests, and implementation of robust authentication mechanisms. Additionally, regular patching and vulnerability assessments should be prioritized to address this weakness before it can be exploited in production environments. The scope change aspect emphasizes the need for comprehensive security monitoring across all interconnected systems that depend on Oracle Coherence services to prevent lateral movement attacks that could compromise additional enterprise assets.