CVE-2026-60242 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability under discussion represents a critical security flaw in Oracle Coherence, a distributed computing platform within Oracle Fusion Middleware that facilitates high-performance data grid solutions. This vulnerability affects specifically version 12.2.1.4.0 and 14.1.1.0.0 of the Oracle Coherence component, which serves as the core infrastructure for managing distributed data across multiple nodes in enterprise environments. The flaw resides in the HTTP handling mechanisms of the Coherence service, creating an exploitable entry point that requires no authentication credentials or prior access privileges from potential attackers.
The technical nature of this vulnerability stems from insufficient input validation and access control measures within the HTTP processing layer of Oracle Coherence. An unauthenticated attacker positioned on the network can exploit this weakness by sending specially crafted HTTP requests to the vulnerable service, bypassing normal authentication requirements that should normally protect the system. The vulnerability's classification as easily exploitable indicates that the attack vector requires minimal technical expertise or resources, making it particularly dangerous in production environments where such services may be exposed to untrusted networks.
The operational impact of this vulnerability is severe and potentially catastrophic for affected organizations. Successful exploitation can result in complete takeover of the Oracle Coherence service, allowing attackers to execute arbitrary code within the context of the running service. This compromise enables unauthorized access to distributed data stores, potential data exfiltration, modification of critical business data, and disruption of services that depend on the coherence grid. The CVSS 3.1 base score of 9.8 reflects the high severity across all impact metrics with high confidentiality, integrity, and availability implications, indicating that an attacker could access sensitive information, modify system state, and cause complete service disruption.
Organizations should immediately implement mitigations including network segmentation to restrict access to Oracle Coherence services, deployment of firewalls and intrusion detection systems to monitor for suspicious HTTP traffic patterns, and application of available patches from Oracle. The vulnerability aligns with CWE-284 (Improper Access Control) and CWE-310 (Cryptographic Issues) categories, while the attack pattern corresponds to techniques described in the MITRE ATT&CK framework under T1190 (Exploit Public-Facing Application) and T1071.004 (Application Layer Protocol: DNS). Organizations must also conduct comprehensive vulnerability assessments of their Oracle Coherence deployments to identify potential exposure points and implement proper network access controls to limit direct internet exposure of these services. The attack scenario demonstrates the critical importance of maintaining up-to-date security patches and implementing defense-in-depth strategies for enterprise middleware components that handle sensitive business data.