CVE-2026-60280 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
Oracle Coherence represents a distributed caching and processing platform within Oracle Fusion Middleware that serves as a critical component for enterprise applications requiring high-performance data management and processing capabilities. This vulnerability exists within the core component of Oracle Coherence and affects specific versions including 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, making it a significant concern for organizations utilizing these middleware versions in their enterprise infrastructure. The vulnerability stems from insufficient authentication mechanisms within the HTTP/2 protocol implementation, creating an attack surface that allows unauthenticated remote exploitation.
The technical flaw manifests as a lack of proper access control validation during HTTP/2 request processing within the Coherence service. Attackers can leverage this weakness by establishing network connections and sending specially crafted HTTP/2 requests without requiring any authentication credentials. This vulnerability classifies under CWE-287 which addresses improper authentication issues, specifically targeting the absence of adequate authentication checks in network services. The attack vector operates through network access with low complexity requirements, meaning that an attacker does not need specialized skills or privileged access to exploit the flaw effectively.
The operational impact of this vulnerability is severe and encompasses complete compromise of the affected Oracle Coherence instances. Successful exploitation enables attackers to gain full control over the distributed caching system, potentially leading to data theft, service disruption, and unauthorized modification of cached data. The CVSS 3.1 score of 9.8 reflects the high severity with impacts across confidentiality, integrity, and availability domains, indicating that an attacker could access sensitive information, modify critical data, and potentially cause system downtime. This vulnerability can result in significant business disruption and financial loss for organizations relying on Coherence for mission-critical applications.
Organizations should implement immediate mitigations including applying Oracle's security patches and updates to the affected versions, implementing network-level restrictions through firewalls to limit access to Coherence services, and configuring authentication mechanisms where possible. The ATT&CK framework categorizes this vulnerability under T1190 - Exploit Public-Facing Application, highlighting the need for proper network segmentation and monitoring of HTTP/2 traffic. Additional defensive measures include implementing intrusion detection systems to monitor for unusual HTTP/2 patterns, conducting regular security assessments of middleware components, and establishing strict access controls for administrative interfaces. Organizations should also consider disabling HTTP/2 protocols if not essential for operations until proper patches are applied and validated in their environments.