CVE-2026-60281 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Coherence executes to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Coherence accessible data as well as unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
Oracle Coherence represents a distributed caching and processing platform within Oracle Fusion Middleware that enables high-performance data management across distributed systems. This vulnerability exists within the core component of the software and affects multiple version lines including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, making it a widespread concern across the Oracle Coherence ecosystem. The vulnerability stems from inadequate authentication mechanisms that allow attackers to exploit the system without requiring valid credentials or access tokens to perform malicious activities.
The technical flaw manifests as a lack of proper authentication controls at the network level where Oracle Coherence operates, specifically within the physical communication segment. This weakness enables what is known as a man-in-the-middle attack vector where an unauthenticated attacker positioned on the same physical network segment can intercept and manipulate communications between Coherence nodes. According to CWE-305 authentication weakness classification, this represents a fundamental flaw in credential validation processes that allows unauthorized access to protected resources without proper authorization checks.
The operational impact of this vulnerability is severe and multifaceted, as successful exploitation provides attackers with comprehensive access to all data managed by Oracle Coherence. This includes the ability to create, delete, or modify critical data within the system, effectively granting full control over enterprise data stores that may contain sensitive business information, customer data, or proprietary intellectual property. The CVSS 3.1 base score of 8.1 reflects the high severity impact across both confidentiality and integrity dimensions, indicating that attackers can potentially access all accessible data while simultaneously modifying critical system information.
This vulnerability aligns with several ATT&CK techniques including T1046 network service scanning and T1566 credential harvesting, as attackers can leverage the physical network access to discover and exploit Coherence services without requiring traditional authentication methods. The attack surface is particularly concerning given that many organizations deploy Oracle Coherence in environments where physical security controls may be insufficiently robust. Organizations running these affected versions face significant risk of data breaches and system compromise when network segmentation policies are inadequate or when attackers can gain access to the same physical network infrastructure where Coherence services operate.
Mitigation strategies should include implementing strict network segmentation policies that isolate Oracle Coherence services from unauthorized network segments, deploying network access controls and firewalls to restrict communication between Coherence nodes, and ensuring that all systems operate with the latest security patches from Oracle. Additionally, organizations should consider implementing intrusion detection systems and monitoring for unusual network activity patterns that may indicate exploitation attempts. The vulnerability's classification as easily exploitable under CVSS 3.1 indicates that organizations must prioritize immediate remediation efforts to protect their distributed data environments from potential compromise.
The vulnerability demonstrates the critical importance of proper authentication controls in distributed systems where physical access can translate directly into logical system compromise. This issue highlights how traditional network security measures may be insufficient when dealing with enterprise middleware solutions that operate at multiple layers of the network stack. Security architects and system administrators must consider not only logical access controls but also physical network security implications when deploying distributed caching solutions like Oracle Coherence, as the attack vector in this case bypasses most traditional authentication mechanisms through simple network-level access.