CVE-2026-60241 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
Oracle Coherence represents a distributed caching and processing platform that forms a critical component within Oracle Fusion Middleware ecosystems, providing enterprise-grade data management capabilities across distributed architectures. This vulnerability exists within the core component of Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, making it a significant concern for organizations relying on these middleware implementations. The flaw manifests as an authentication bypass vulnerability that allows attackers to access the system without requiring valid credentials, representing a fundamental failure in the platform's security controls.
The technical nature of this vulnerability stems from insufficient authentication mechanisms within the HTTP interface of Oracle Coherence, creating an attack vector that can be exploited remotely by unauthenticated adversaries. This weakness specifically affects the Core component and operates at the network level, enabling attackers to establish connections directly through HTTP protocols without proper verification. The CVSS 3.1 score of 9.8 indicates a critical severity level with high impacts across confidentiality, integrity, and availability domains, suggesting that successful exploitation can result in complete system compromise.
From an operational perspective, this vulnerability presents a severe threat to enterprise environments where Oracle Coherence serves as a foundational data management platform. The ability for unauthenticated attackers to gain control over the system means they can potentially access sensitive data, modify critical configurations, disrupt services, and establish persistent access points within the network infrastructure. Organizations utilizing these affected versions face immediate risk of data breaches, service interruptions, and potential lateral movement attacks that could compromise broader enterprise networks. The vulnerability's ease of exploitation further compounds the risk as it requires minimal technical expertise to execute successful attacks.
The attack surface for this vulnerability aligns with ATT&CK framework techniques including T1190 (Exploit Public-Facing Application) and T1071.004 (Application Layer Protocol: DNS), as attackers can leverage HTTP protocols to reach the vulnerable endpoints without authentication requirements. This vulnerability directly maps to CWE-287 (Improper Authentication) and potentially CWE-312 (Cleartext Storage of Sensitive Information) if sensitive data is stored in cleartext within the compromised system. Organizations should prioritize immediate patching of affected systems, implement network segmentation controls, and consider deploying intrusion detection systems to monitor for exploitation attempts.
Mitigation strategies should include immediate deployment of Oracle's security patches and updates, followed by comprehensive network access controls that restrict HTTP access to trusted administrative networks only. Security administrators should also implement monitoring solutions that can detect unusual traffic patterns or unauthorized access attempts to the Coherence endpoints. Additionally, organizations should conduct thorough vulnerability assessments to identify any potential exploitation attempts and consider implementing additional authentication layers or reverse proxies to add defense-in-depth measures against similar vulnerabilities in other components of their Oracle Fusion Middleware infrastructure.