CVE-2026-60283 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Coherence, a distributed caching and processing platform that forms part of Oracle Fusion Middleware suite. The affected versions span across multiple release lines including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, indicating a widespread impact across the product's lifecycle. The vulnerability is classified as easily exploitable, meaning that attackers can leverage it without requiring specialized skills or access credentials, making it particularly dangerous in environments where network exposure is inevitable.
The technical flaw manifests as a security weakness in the Core component of Oracle Coherence that allows unauthorized access through HTTP protocols. This represents a critical design oversight where authentication mechanisms fail to properly validate incoming requests, enabling any network-connected attacker to establish communication with the system without providing credentials. The vulnerability's CVSS 3.1 base score of 5.3 places it in the medium severity category, though its ease of exploitation and the potential for data compromise make it significantly more dangerous than typical medium severity issues.
The operational impact of this vulnerability extends beyond simple information disclosure. An attacker who successfully exploits this weakness can gain unauthorized read access to a subset of Oracle Coherence's accessible data, potentially exposing sensitive information stored within distributed caches. This could include customer data, business intelligence, configuration details, or any other information that has been cached for performance optimization purposes. The scope of affected data depends on the specific implementation and configuration of the Coherence cluster, but the potential for exposure remains substantial given that access requires no authentication credentials.
From a threat modeling perspective, this vulnerability aligns with CWE-287 which addresses improper authentication issues in software systems. The attack vector AV:N indicates network-based exploitation, while the lack of required privileges PR:N and user interaction UI:N demonstrates how easily accessible this attack surface is to external threat actors. This vulnerability also maps to ATT&CK technique T1046 which involves network service scanning, as attackers would likely first identify exposed HTTP endpoints before attempting exploitation. The absence of integrity or availability impacts (C:L/I:N/A:N) suggests that while confidentiality is compromised, the system's operational functionality remains largely intact.
Organizations should implement immediate mitigations including firewall restrictions to block unauthorized HTTP access to Coherence services, deployment of network segmentation strategies, and application of Oracle's security patches as they become available. Additional protective measures include monitoring for unusual HTTP traffic patterns and implementing intrusion detection systems that can identify exploitation attempts targeting this specific vulnerability. The recommended approach involves comprehensive network access controls combined with regular security assessments to ensure that no unauthorized access points remain open to external threat actors seeking to exploit this weakness.