CVE-2026-60273 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Coherence, a distributed caching and processing platform that forms part of Oracle Fusion Middleware suite. The affected versions span across multiple release lines including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, indicating a widespread issue affecting the core functionality of this middleware component. The vulnerability is classified as difficult to exploit, meaning that while it requires some technical knowledge or specific conditions to be successfully leveraged, the attack surface remains significant given that no authentication is required for exploitation.
The technical flaw manifests as a network-based vulnerability that can be exploited through TCP connections without any prior authentication credentials. This characteristic places the system at risk from external attackers who can simply establish network connectivity to the affected Oracle Coherence instances. The CVSS base score of 8.1 reflects the severity of impact across all three core security properties - confidentiality, integrity, and availability - with high scores across each category indicating that successful exploitation can result in complete compromise of the system. The attack vector AV:N indicates network accessibility, while AC:H suggests that the attack requires some level of technical sophistication to execute successfully.
The operational impact of this vulnerability is particularly severe as it allows for complete takeover of Oracle Coherence systems, which typically serve as critical distributed caching layers within enterprise architectures. This compromise can lead to unauthorized data access, modification of cached data, service disruption through availability impacts, and potential lateral movement within the network infrastructure. The vulnerability affects the Core component of Oracle Coherence, suggesting that it targets fundamental functionality rather than isolated features, thereby amplifying the potential damage scope.
From a cybersecurity framework perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and may map to ATT&CK techniques such as T1071.004 (Application Layer Protocol: DNS) and T1566 (Phishing). The lack of authentication requirements makes it particularly dangerous in environments where Oracle Coherence instances are exposed to untrusted networks or the internet directly. Organizations utilizing these affected versions should prioritize immediate mitigation efforts, including network segmentation, firewall rule implementation, and applying official patches from Oracle as soon as they become available.
The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) clearly indicates that this vulnerability operates with high attack complexity requirements but delivers maximum impact across all security dimensions. The fact that this affects multiple versions simultaneously suggests either a fundamental architectural flaw or a persistent issue within the core codebase that has not been properly addressed through version updates. This makes the vulnerability particularly concerning as it may require organizations to upgrade across multiple release lines rather than simply patching a single version, compounding the operational complexity and potential business disruption associated with remediation efforts.
Organizations should implement comprehensive monitoring of network traffic to detect unusual patterns that might indicate exploitation attempts against Oracle Coherence services. The vulnerability's exposure through TCP connections means standard network detection mechanisms should be enhanced to identify suspicious connection attempts or malformed requests targeting the affected service ports. Additionally, regular security assessments and penetration testing should include evaluation of distributed caching systems to identify similar vulnerabilities that may exist in other middleware components within the enterprise infrastructure.
The remediation approach should involve immediate implementation of network controls such as restricting access to Oracle Coherence instances through firewalls and implementing strict access control policies. Organizations should also consider deploying intrusion detection/prevention systems with signatures specifically targeting Oracle Coherence exploitation patterns. The patch management process must be prioritized, with careful testing of patches in staging environments before production deployment to ensure that the security fixes do not introduce compatibility issues within existing applications that depend on Oracle Coherence functionality.