CVE-2026-60295 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
Oracle Coherence represents a critical distributed caching and processing platform within Oracle Fusion Middleware that serves as a foundational component for enterprise-scale applications requiring high-performance data management. This vulnerability exists within the Core component of Oracle Coherence and affects specific version releases including 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, making it a widespread concern across multiple supported release lines. The technical flaw manifests as a security weakness that can be exploited by low-privileged attackers who possess network access through TCP connections, indicating that the vulnerability does not require elevated privileges to initiate attacks. The CVSS 3.1 scoring of 8.5 reflects the severity of this issue with high impacts across confidentiality, integrity, and availability domains, demonstrating the comprehensive nature of potential compromise.
The attack vector specifically leverages network connectivity via TCP protocols, which means that an attacker positioned outside the organization's network boundary could potentially exploit this vulnerability without requiring physical access or prior authentication credentials. This characteristic places the vulnerability in the category of remotely exploitable security flaws that can be targeted by threat actors with minimal initial access requirements. The scope change aspect of this vulnerability is particularly concerning as it indicates that successful exploitation may extend beyond Oracle Coherence itself to impact additional products within the broader Oracle Fusion Middleware ecosystem, potentially creating cascading effects throughout enterprise infrastructure. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) clearly demonstrates the high attack complexity requirements (AC:H) while maintaining low privilege requirements (PR:L), highlighting that sophisticated exploitation techniques are not necessary but network-based access remains crucial.
From a cybersecurity perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and potentially CWE-125 (Out-of-Bounds Read) or CWE-79 (Cross-site Scripting) depending on the specific exploitation method employed. The potential for complete system compromise represents a significant threat to enterprise security posture, as Oracle Coherence typically operates as a critical infrastructure component managing distributed data across multiple nodes in enterprise environments. Attackers could leverage this vulnerability to achieve full control over affected Coherence instances, potentially enabling them to manipulate distributed caches, access sensitive data, or disrupt business operations. The impact extends beyond simple data compromise to include complete system takeover capabilities that could allow attackers to establish persistent access points within enterprise networks.
The operational implications of this vulnerability are substantial for organizations utilizing Oracle Fusion Middleware deployments, as it creates opportunities for attackers to gain unauthorized access to critical distributed computing resources. Organizations should consider implementing network segmentation strategies to limit exposure of Oracle Coherence instances to untrusted networks while also applying appropriate firewall rules to restrict TCP port access. The vulnerability's classification under ATT&CK framework may correspond to techniques such as T1190 (Exploit Public-Facing Application) and T1071.004 (Application Layer Protocol: DNS) if exploitation involves network-based reconnaissance. Mitigation strategies should include immediate patch deployment for affected versions, network monitoring for suspicious TCP traffic patterns, and implementation of additional security controls such as intrusion detection systems to detect potential exploitation attempts. Organizations must also conduct comprehensive risk assessments to identify all instances of affected Oracle Coherence deployments across their infrastructure and prioritize remediation efforts accordingly.