CVE-2026-60250 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
Oracle Coherence represents a distributed caching and processing platform that forms a critical component within Oracle Fusion Middleware ecosystems, serving as a backbone for enterprise-scale data management and application coordination. This vulnerability exists within the core functionality of the software and affects multiple version lines including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, indicating a widespread impact across the product lifecycle. The flaw resides in how the system handles incoming network connections through the TCP protocol, creating an avenue for unauthorized access without requiring any authentication credentials or prior privileges.
The technical nature of this vulnerability stems from insufficient input validation and inadequate access controls within the Coherence service implementation. Attackers can exploit this weakness by establishing direct network connections to the affected Oracle Coherence instances, bypassing traditional authentication mechanisms entirely. This unauthenticated access provides attackers with complete control over the targeted Coherence services, enabling them to execute arbitrary code, manipulate data structures, or disrupt service availability. The CVSS score of 9.8 reflects the severe impact potential with high scores across all three confidentiality, integrity, and availability vectors, indicating that successful exploitation could result in full system compromise.
From an operational standpoint, this vulnerability poses significant risks to enterprise environments that rely on Oracle Coherence for mission-critical applications and data processing. The ease of exploitation means that attackers can quickly gain unauthorized access without specialized tools or extensive reconnaissance, making it particularly dangerous in production environments where such services may be exposed to untrusted networks. Organizations using affected versions face potential data breaches, service disruptions, and complete system takeovers that could affect business continuity and regulatory compliance requirements. The vulnerability's impact extends beyond individual instances as Coherence often serves as a distributed processing layer that can affect entire application architectures.
Mitigation strategies should prioritize immediate patching of all affected Oracle Coherence versions through official Oracle security updates, which address the underlying validation and access control flaws. Network segmentation and firewall rules should be implemented to restrict direct TCP access to Coherence services from untrusted networks, while also considering the deployment of network intrusion detection systems to monitor for suspicious connection patterns. Organizations should conduct comprehensive inventory audits to identify all instances running affected versions and implement monitoring procedures to detect unauthorized access attempts. The vulnerability aligns with CWE-284 (Improper Access Control) and can be categorized under ATT&CK technique T1190 (Exploit Public-Facing Application) and T1071.1003 (Application Layer Protocol: Dns). Additionally, implementing network-level protections such as TCP wrappers or VPN access controls can provide additional defense-in-depth measures while awaiting official patches to be deployed across all affected systems.