CVE-2026-60269 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
Oracle Coherence represents a distributed caching and processing platform that forms a critical component within Oracle Fusion Middleware ecosystems, providing enterprise-grade data management capabilities across distributed architectures. This vulnerability exists within the core networking components of Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, making it particularly concerning given the widespread deployment of these middleware components across enterprise environments. The flaw manifests as an authentication bypass vulnerability that allows remote attackers to establish connections without proper credentials, effectively undermining the security posture of affected systems.
The technical nature of this vulnerability stems from insufficient input validation and authentication mechanisms within the TCP listening components of Oracle Coherence. Attackers can exploit this weakness by simply establishing network connections to the vulnerable service ports, bypassing all standard authentication procedures that should normally validate client identities and permissions. This unauthenticated access creates a pathway for attackers to execute arbitrary commands on the affected systems, potentially leading to complete system compromise. The CVSS score of 9.8 reflects the severity of the impact, where confidentiality, integrity, and availability are all critically compromised, indicating that successful exploitation can result in complete system takeover.
The operational impact of this vulnerability extends far beyond simple network access, as Oracle Coherence systems typically serve as foundational components for enterprise applications, data grids, and distributed processing frameworks. When compromised, attackers gain access to sensitive business data, can manipulate application behavior, and potentially use the compromised system as a launching point for further attacks within the enterprise network. The ease of exploitation, combined with the lack of authentication requirements, means that this vulnerability can be exploited by virtually any attacker with network connectivity to the affected systems, making it particularly dangerous in environments where such services are exposed to untrusted networks.
Organizations should implement immediate mitigations including network segmentation to restrict access to Oracle Coherence ports, deployment of firewall rules limiting access to trusted IP addresses only, and application of available patches from Oracle. The vulnerability aligns with CWE-287, which addresses improper authentication issues, and maps to ATT&CK technique T1190 for exploitation of remote services, while also representing a significant risk for lateral movement within enterprise environments where Coherence systems are deployed across multiple network segments. Organizations must conduct comprehensive inventory assessments to identify all affected systems and implement layered security controls to protect against this type of attack vector that can result in complete system compromise and data exposure.