CVE-2026-60264 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
Oracle Coherence represents a distributed caching and processing platform within Oracle Fusion Middleware that serves as a critical component for enterprise-scale applications requiring high-performance data management and processing capabilities. This vulnerability exists within the core functionality of the software and affects specific version ranges including 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, making it particularly concerning for organizations maintaining these legacy systems. The flaw resides in how the system handles incoming HTTP/2 connections, creating an exploitable entry point that requires no authentication credentials from potential attackers.
The technical nature of this vulnerability stems from insufficient input validation and access control mechanisms within the Coherence service's HTTP/2 handling code. An unauthenticated attacker positioned on the network can exploit this weakness by establishing HTTP/2 connections to the affected Oracle Coherence instances, bypassing traditional authentication requirements that would normally prevent unauthorized access. This type of vulnerability maps directly to CWE-284 Access Control Issues, specifically addressing inadequate permissions and authentication controls within network services.
The operational impact of successful exploitation reaches the highest severity levels as measured by CVSS 3.1 scoring with a base score of 9.8 indicating high confidentiality, integrity, and availability impacts. Attackers who successfully compromise Oracle Coherence systems gain complete control over the distributed caching infrastructure, potentially leading to data breaches, service disruption, and system takeover scenarios. The vulnerability's ease of exploitation means that attackers can achieve system compromise without requiring specialized tools or extensive reconnaissance efforts beyond basic network access.
Organizations should immediately implement network segmentation controls to restrict access to Oracle Coherence instances, particularly those exposed to untrusted networks. The recommended mitigations include applying the latest security patches from Oracle as soon as they become available, implementing strict firewall rules that limit HTTP/2 access to trusted IP addresses only, and conducting thorough network monitoring for suspicious connection patterns. Additionally, organizations should consider disabling HTTP/2 support entirely if it is not required for business operations, as this removes the attack surface associated with this specific vulnerability. From an ATT&CK framework perspective, this vulnerability aligns with techniques involving initial access through network service exploitation and privilege escalation via system compromise, making it a critical target for immediate remediation efforts.