CVE-2026-60297 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
Oracle Coherence represents a distributed caching and processing platform that forms a critical component within Oracle Fusion Middleware ecosystems, providing high-performance data management capabilities across distributed environments. This vulnerability exists within the core networking stack of Coherence implementations across multiple version lines including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, making it a widespread concern for enterprise deployments relying on Oracle's middleware infrastructure.
The technical flaw manifests as a critical security weakness in the authentication mechanisms governing TCP network connections to the Coherence service. This vulnerability operates at the network protocol level where incoming connections are not properly validated before being accepted into the distributed caching system. Attackers can exploit this weakness by establishing direct TCP connections to the Coherence service without providing any authentication credentials, effectively bypassing all access controls that should normally protect the distributed data grid.
The operational impact of this vulnerability extends far beyond simple unauthorized access as it enables complete system compromise through what is classified as a high-severity attack vector. An unauthenticated attacker can achieve full control over the Oracle Coherence instance, potentially leading to complete data theft, system disruption, and service availability degradation across the enterprise. The CVSS 3.1 score of 9.8 indicates this represents a critical risk level with high exploitability and severe consequences for all three core security principles. The attack requires no user interaction and can be executed from any network location, making it particularly dangerous in exposed environments.
This vulnerability aligns with CWE-287 which addresses improper authentication issues within network services, specifically targeting the failure to implement proper access control mechanisms for remote connections. From an adversarial perspective, this flaw maps directly to attack techniques described in the MITRE ATT&CK framework under T1190 - Exploit Public-Facing Application and T1046 - Network Service Scanning, where attackers can leverage open ports to establish unauthorized connections. The compromised Coherence service becomes a potential pivot point for further attacks within the enterprise network, as distributed caching systems often integrate with other critical enterprise components.
Organizations should implement immediate mitigations including network-level restrictions through firewalls and access control lists to block unauthorized TCP access to Coherence ports, particularly those associated with the default clustering and management interfaces. The most effective defensive measures involve restricting access to the Coherence service from untrusted networks and implementing proper authentication mechanisms for all remote connections. Additionally, organizations should consider deploying intrusion detection systems to monitor for unusual connection patterns and establish network segmentation policies that isolate critical middleware components from general network access. Regular vulnerability assessments and patch management processes should be prioritized to address this flaw promptly across all affected versions within the Oracle Fusion Middleware ecosystem.