CVE-2026-60290 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
Oracle Coherence represents a distributed caching and processing platform that forms a critical component within Oracle Fusion Middleware ecosystems, providing high-performance data management capabilities across distributed environments. This vulnerability exists within the core component of Oracle Coherence and affects specific versions including 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, making it a significant concern for organizations utilizing these middleware implementations. The vulnerability manifests as an easily exploitable flaw that permits unauthenticated attackers to gain network-level access through HTTP protocols, effectively bypassing traditional authentication mechanisms that would normally protect such critical infrastructure components.
The technical nature of this vulnerability stems from insufficient input validation and authentication controls within the HTTP handling mechanisms of Oracle Coherence, creating a path for remote code execution or complete system compromise. The CVSS 3.1 scoring system assigns a base score of 9.8, indicating a severe impact across all three core security principles: confidentiality, integrity, and availability. This classification places the vulnerability in the highest severity category, where the attacker requires minimal privileges and technical expertise to achieve successful exploitation. The attack vector analysis reveals that the vulnerability is accessible over the network without requiring any prior authentication credentials or privileged access.
The operational impact of this vulnerability extends far beyond simple data compromise, as successful exploitation can result in complete takeover of Oracle Coherence systems, potentially leading to widespread service disruption and data breaches across enterprise environments. Organizations relying on distributed caching architectures for mission-critical applications face substantial risk from this vulnerability, as it could enable attackers to manipulate cached data, disrupt application availability, or extract sensitive information from memory caches. The implications are particularly severe given that Oracle Coherence serves as a foundational component in many enterprise architectures, meaning compromise of this system could cascade into broader infrastructure failures.
Security professionals should immediately implement network segmentation and access controls to limit exposure of Oracle Coherence systems to untrusted networks while applying available patches from Oracle to address the identified vulnerability. The mitigation strategy must include comprehensive monitoring of HTTP traffic for suspicious patterns and implementation of firewall rules that restrict unnecessary access to Coherence ports. Organizations should also consider deploying intrusion detection systems specifically configured to detect exploitation attempts targeting this vulnerability, as the ease of exploitation means that automated attack tools are likely to be deployed against vulnerable systems.
This vulnerability aligns with CWE-287, which addresses improper authentication issues in software systems, and represents a classic example of how insufficient access controls can lead to complete system compromise. From an ATT&CK framework perspective, this vulnerability maps to techniques involving initial access through network services and privilege escalation, as attackers can leverage the unauthenticated access to gain deeper control over affected systems. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) emphasizes that no user interaction is required for exploitation, and that the attack can be conducted from any network location with HTTP connectivity, making it particularly dangerous in exposed environments.
Organizations should conduct immediate vulnerability assessments to identify all systems running affected Oracle Coherence versions and prioritize remediation efforts accordingly. The patch management process must include thorough testing of updated components to ensure compatibility with existing enterprise applications while maintaining security posture. Additional defensive measures should encompass implementation of network access controls, regular security audits of Coherence configurations, and development of incident response procedures specifically tailored to address this type of vulnerability. The combination of these factors makes this vulnerability particularly concerning for organizations that have not yet implemented comprehensive security monitoring solutions for their middleware infrastructure.
The broader implications extend to industry standards compliance and regulatory requirements, as exploitation of this vulnerability could result in violations of data protection regulations and security framework mandates. Organizations must ensure that their security architectures account for the potential compromise of distributed caching systems, as these components often contain sensitive business data and process critical transactions across enterprise networks. Regular security assessments should include evaluation of middleware components to identify similar vulnerabilities that may exist within other Oracle Fusion Middleware products or related infrastructure elements.