CVE-2026-60240 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
Oracle Coherence represents a distributed caching and processing platform that forms a critical component within Oracle Fusion Middleware ecosystems, handling sensitive data aggregation and real-time processing across enterprise environments. This vulnerability resides within the core component of the software, specifically affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, making it a widespread concern across multiple release lines of the platform. The flaw manifests as an easily exploitable security weakness that does not require authentication credentials for successful exploitation, presenting a significant risk to organizations relying on these middleware implementations.
The technical nature of this vulnerability stems from insufficient access controls within the TCP communication layer of Oracle Coherence, allowing unauthenticated attackers to establish network connections and potentially execute malicious code against affected systems. This represents a critical design flaw that violates fundamental security principles of authentication and authorization, as outlined in CWE-287 which addresses improper authentication issues. The vulnerability's exploitability is enhanced by its low attack complexity requirement, with CVSS score of 9.8 indicating high severity across all impact vectors including confidentiality, integrity, and availability.
Operational impacts of this vulnerability extend far beyond simple data compromise, as successful exploitation can result in complete system takeover of Oracle Coherence instances, potentially enabling attackers to access sensitive enterprise data, disrupt business operations, and establish persistent access points within organizational networks. The lack of authentication requirements means that attackers can exploit this weakness from external network positions without needing prior credentials or insider knowledge, making it particularly dangerous in environments where these systems are exposed to public internet access. This vulnerability directly maps to ATT&CK technique T1071.004 for application layer protocol usage and T1046 for network service scanning.
Organizations must implement immediate mitigations including network segmentation to restrict direct TCP access to Coherence instances, deployment of firewalls to block unnecessary ports, and application of Oracle's security patches as soon as they become available. The vulnerability highlights the importance of maintaining current security postures through regular patch management processes, particularly for critical middleware components that handle enterprise data. Additionally, organizations should conduct comprehensive network assessments to identify all exposed Coherence instances and implement monitoring solutions to detect potential exploitation attempts, given the high impact potential of this vulnerability.