CVE-2026-60265 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Coherence executes to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Coherence, a distributed computing platform that forms part of Oracle Fusion Middleware, specifically within the Core component of the software stack. The affected versions span across multiple release lines including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, indicating a widespread issue that impacts the core functionality of Oracle's distributed caching solution. The vulnerability classification as easily exploitable suggests that attackers with minimal technical sophistication can leverage this flaw once they have established a foothold within the target infrastructure. According to CVSS scoring methodology, the base score of 6.0 reflects a medium severity threat with high confidentiality impact, while the vector indicates local attack access (AV:L), low complexity requirements (AC:L), and high privileges required for exploitation (PR:H).
The technical nature of this vulnerability stems from insufficient security controls within Oracle Coherence that allow privilege escalation attacks to compromise the system's integrity. Attackers who already possess legitimate login credentials to the infrastructure hosting Oracle Coherence can exploit this weakness to gain unauthorized access to critical data stored within the distributed cache environment. The vulnerability demonstrates a scope change impact, meaning that while initially targeting Oracle Coherence specifically, successful exploitation can potentially affect additional products and systems within the broader Oracle Fusion Middleware ecosystem. This characteristic aligns with CWE-276 which addresses improper privileges and privilege escalation in software systems, representing a fundamental security weakness that allows attackers to elevate their access rights beyond what is normally permitted.
From an operational perspective, this vulnerability presents significant risk to organizations relying on Oracle Coherence for mission-critical distributed applications and data caching. The potential impact includes complete unauthorized access to all data accessible through the Oracle Coherence system, which could result in substantial data breaches and business disruption. The CVSS vector specifically indicates that confidentiality is the primary concern with a high impact score (C:H) while integrity (I:N) and availability (A:N) remain relatively unaffected, suggesting that attackers primarily seek to extract sensitive information rather than disrupt service availability. This vulnerability represents a serious concern for organizations operating in regulated environments where data protection and privacy compliance are paramount.
Organizations should implement immediate mitigations including applying the relevant Oracle security patches and updates as released through Oracle Critical Patch Updates or similar mechanisms. Network segmentation and access control measures should be strengthened to limit lateral movement within the infrastructure, particularly restricting direct access to Oracle Coherence hosts from unauthorized systems. Monitoring for unusual authentication patterns and privilege escalation attempts should be enhanced through security information and event management systems. The vulnerability also highlights the need for comprehensive application security testing including penetration testing of distributed caching environments, aligning with ATT&CK framework techniques such as privilege escalation and credential access. Additional defensive measures include implementing least privilege principles for Oracle Coherence service accounts and regular security assessments of middleware components to identify similar vulnerabilities in other enterprise systems.