CVE-2026-60249 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Coherence executes to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Coherence, a distributed caching and processing platform that forms part of Oracle Fusion Middleware, specifically affecting core components of the system. The affected versions span across multiple release lines including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, indicating a widespread impact across the product lifecycle. The vulnerability's classification as easily exploitable suggests that attackers with minimal privileges and access to the physical communication segment can successfully compromise the system. This attack vector represents a significant security risk as it requires only local network access rather than complex remote exploitation techniques.
The technical flaw manifests in how Oracle Coherence handles communications and authentication processes, allowing an attacker who has physical access to the network segment where the software operates to gain full control over the Coherence instance. This represents a critical weakness in the system's security architecture, as it essentially provides a backdoor for unauthorized access through legitimate network channels. The CVSS 3.1 score of 9.0 reflects the high severity impact across all three core security principles: confidentiality, integrity, and availability. The attack complexity is rated as low (AC:L) meaning minimal technical expertise is required, while the privilege requirement is also low (PR:L), indicating that attackers need only basic access rights to exploit this vulnerability.
The operational impact extends beyond just the immediate Oracle Coherence system, creating a cascading effect that can significantly affect other connected products and services within the broader Oracle Fusion Middleware ecosystem. This scope change aspect means that compromising one component can potentially lead to widespread system compromise across multiple applications and services that depend on or interact with Oracle Coherence. Organizations utilizing this technology face substantial risk of data breaches, service disruption, and potential complete system takeover, making this vulnerability particularly dangerous in enterprise environments where Coherence typically serves as a critical infrastructure component for distributed data processing.
The attack surface is further widened by the requirement for physical access to the communication segment, which suggests that network segmentation controls may be insufficient or improperly configured. This weakness aligns with common security principles outlined in CWE categories related to network communication vulnerabilities and inadequate access controls. From an adversarial perspective, this vulnerability maps to ATT&CK techniques involving network infiltration and privilege escalation through local network access. Organizations should implement immediate mitigations including enhanced network segmentation, mandatory access controls, and regular monitoring of network traffic for anomalous patterns that might indicate exploitation attempts. The comprehensive approach to mitigation must also consider the broader ecosystem impact, ensuring that any compromised Coherence instances do not serve as launch points for attacks against other interconnected systems within the enterprise infrastructure.