CVE-2026-60268 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
Oracle Coherence represents a distributed caching and processing platform within Oracle Fusion Middleware that enables organizations to scale applications across multiple nodes while maintaining data consistency. This vulnerability exists within the core component of Oracle Coherence and affects specific version releases including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, making it a critical concern for enterprises utilizing these middleware implementations. The flaw manifests as an easily exploitable security weakness that can be leveraged by attackers with minimal privileges who possess network access through the TCP protocol.
The technical nature of this vulnerability stems from insufficient authentication and authorization controls within the Coherence communication layer, allowing unauthorized actors to establish connections and potentially execute malicious operations against the distributed caching infrastructure. Attackers can exploit this weakness by establishing TCP connections to the affected Oracle Coherence instances without proper credential verification, creating a pathway for privilege escalation and system compromise. This vulnerability directly maps to CWE-287 which addresses improper authentication issues in software systems, specifically targeting weak session management and authentication mechanisms that permit unauthorized access to protected resources.
The operational impact of this vulnerability is severe given the critical role Oracle Coherence plays in enterprise application architectures. Successful exploitation can lead to complete system compromise where attackers gain full control over the distributed caching infrastructure, potentially resulting in data theft, service disruption, and unauthorized modification of cached data across multiple application nodes. The CVSS 3.1 score of 8.8 reflects high severity across all impact vectors with high confidentiality, integrity, and availability implications, indicating that an attacker could access sensitive information, modify critical data structures, and potentially cause system outages affecting business operations.
Organizations should prioritize immediate mitigation measures including applying Oracle's security patches and updates to affected versions, implementing network segmentation to restrict access to Coherence ports, and configuring proper firewall rules to limit TCP connections to trusted sources only. The vulnerability aligns with ATT&CK technique T1190 which describes exploitation of remote services through network-based attacks, making it particularly relevant for organizations monitoring for lateral movement and privilege escalation activities. Additional defensive measures include enabling network intrusion detection systems to monitor for unusual TCP connection patterns targeting Coherence instances and conducting regular security assessments of middleware deployments to identify similar authentication weaknesses in other enterprise components.