CVE-2026-60266 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
Oracle Coherence represents a distributed caching and processing platform that forms a critical component within Oracle Fusion Middleware ecosystems, providing data grid functionality across distributed applications. This vulnerability resides within the core component of the software and affects multiple version lines including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, indicating a widespread impact across the product lifecycle. The vulnerability manifests as a security flaw that can be exploited by unauthenticated attackers who possess network access through TLS protocols, presenting a significant risk to organizations relying on this middleware for critical data operations.
The technical nature of this vulnerability stems from insufficient authentication mechanisms within the Oracle Coherence implementation, allowing remote attackers to bypass normal access controls without requiring valid credentials. The CVSS score of 5.9 reflects the moderate severity level with high attack complexity and no privilege requirements, suggesting that the flaw exists in how the system handles incoming TLS connections and validates client authentication. This weakness enables attackers to potentially access sensitive data stored within the Coherence grid or gain complete access to all accessible data within the distributed caching environment.
The operational impact of this vulnerability extends beyond simple data exposure, as compromised Oracle Coherence systems could lead to unauthorized data manipulation, service disruption, or complete system compromise within the broader Fusion Middleware infrastructure. Organizations utilizing these affected versions face risks including data breaches, intellectual property theft, and potential regulatory compliance violations. The distributed nature of Coherence means that a successful attack could potentially affect multiple nodes within a cluster, amplifying the scope of possible damage.
Security mitigations for this vulnerability should include immediate deployment of Oracle's official patches and updates, implementation of network segmentation to limit access to Coherence endpoints, and enhanced monitoring of TLS traffic for suspicious patterns. Organizations should also consider disabling unnecessary network services, implementing strict firewall rules, and conducting comprehensive security assessments of their middleware environments. The vulnerability aligns with CWE-287 which addresses improper authentication issues, and may be categorized under ATT&CK techniques related to credential access and privilege escalation through network-based attacks. Given the potential for complete data compromise, organizations should prioritize remediation efforts and consider implementing additional security controls such as encrypted communications, access logging, and regular vulnerability scanning to protect against similar threats in their distributed computing environments.