CVE-2026-60286 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability under discussion represents a critical security flaw within Oracle Coherence, a distributed caching and processing platform that forms part of Oracle Fusion Middleware. This vulnerability affects multiple versions including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, indicating a widespread impact across the product's lifecycle. The flaw resides in the Core component of Oracle Coherence, which serves as the fundamental building block for distributed computing operations within the middleware stack. Given that this is an easily exploitable vulnerability with no authentication requirements, it presents a significant risk to organizations relying on this technology for critical data processing and caching operations.
The technical nature of this vulnerability allows an unauthenticated attacker to leverage network access via HTTP protocols to compromise Oracle Coherence systems. This attack vector operates at the network level without requiring any prior credentials or privileged access, making it particularly dangerous as it can be exploited from external networks. The vulnerability's classification as easily exploitable means that attackers can likely execute successful attacks with minimal technical expertise or resources, potentially leading to complete system compromise. The CVSS 3.1 base score of 9.8 reflects the severity of impacts across all three core security principles: confidentiality, integrity, and availability, indicating that a successful exploitation could result in full system takeover.
From an operational perspective, the impact of this vulnerability extends beyond simple data compromise to encompass complete system control and potential business disruption. When an attacker achieves a takeover of Oracle Coherence, they gain access to distributed caching systems that often contain sensitive application data, session information, and processing capabilities essential to enterprise applications. The availability impact suggests that attackers could potentially disrupt services through denial-of-service attacks or by corrupting system operations. This vulnerability aligns with CWE-284 (Improper Access Control) and represents a significant deviation from expected security boundaries within the Oracle Coherence implementation. The attack surface is further expanded by the fact that this affects multiple versions, meaning organizations using any of these specific releases are at risk regardless of their particular deployment configuration.
Organizations must implement immediate mitigations to address this vulnerability, including network-level restrictions such as firewall rules limiting HTTP access to Oracle Coherence components, implementing authentication mechanisms where possible, and applying available patches from Oracle. The ATT&CK framework would categorize this vulnerability under techniques related to network service scanning and exploitation of remote services, specifically targeting the application layer. Organizations should also consider implementing monitoring solutions to detect unauthorized access attempts or unusual network traffic patterns that might indicate exploitation attempts. The vulnerability's impact on confidentiality means that sensitive data stored in distributed caches could be exposed, while integrity concerns suggest potential data corruption or manipulation. Availability impacts could result in service disruption affecting business continuity and application performance.
The broader implications of this vulnerability extend to enterprise security posture, as Oracle Coherence systems often serve as critical infrastructure components within large-scale applications. This flaw demonstrates the importance of maintaining up-to-date security patches for middleware platforms and implementing layered security approaches. Organizations should conduct comprehensive assessments of their Oracle Coherence deployments across all affected versions to identify exposed systems and implement appropriate controls. The vulnerability also highlights the need for regular security testing and vulnerability scanning to identify similar weaknesses in distributed computing environments that could be exploited by threat actors with similar attack patterns targeting middleware platforms.