CVE-2026-60302 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability under examination affects Oracle Coherence, a distributed caching and processing platform within Oracle Fusion Middleware that serves as a critical component for enterprise-scale applications requiring high-performance data management and processing capabilities. This specific flaw resides in the Core component of Oracle Coherence and impacts multiple supported versions including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, indicating a widespread exposure across the product lifecycle. The vulnerability's classification as easily exploitable suggests that attackers require minimal technical expertise or resources to leverage this weakness effectively.
The technical nature of this vulnerability manifests as a security flaw that permits unauthenticated network-based attacks through TCP connections, eliminating the need for prior authorization or credentials to initiate exploitation attempts. This characteristic places Oracle Coherence systems at significant risk since any network-accessible instance can potentially be compromised without proper authentication mechanisms being enforced. The attack vector specifically targets the TCP protocol layer, suggesting that the vulnerability may involve improper input validation, inadequate access controls, or flawed session management within the Coherence communication protocols.
The operational impact of successful exploitation results in complete system compromise, allowing attackers to gain full control over Oracle Coherence instances and their underlying resources. This level of compromise poses severe implications for organizations relying on Coherence for mission-critical data processing and caching operations. The CVSS 3.1 base score of 9.8 reflects the high severity nature of this vulnerability, with all three impact metrics - confidentiality, integrity, and availability - rated as high. Such comprehensive impact ratings indicate that attackers can not only access sensitive data stored within Coherence instances but also modify system state and potentially disrupt service availability entirely.
The vulnerability's classification aligns with CWE-284 (Improper Access Control) and potentially CWE-312 (Cleartext Storage of Sensitive Information) depending on the specific implementation details, while its exploitation pattern corresponds to ATT&CK techniques involving network infiltration and privilege escalation. Organizations utilizing Oracle Coherence are particularly vulnerable since these products often serve as foundational components for enterprise applications, making successful compromises capable of affecting broader system architectures and data ecosystems. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) emphasizes the network-based accessibility with low attack complexity, no prerequisites, and no user interaction required, further amplifying the threat level.
Mitigation strategies should prioritize immediate patching of affected Oracle Coherence versions through official Oracle security updates, while network segmentation and firewall rules can provide temporary protective measures by restricting TCP access to authorized networks only. Additionally, implementing network monitoring solutions capable of detecting anomalous traffic patterns related to Coherence protocols can aid in early threat detection and incident response activities. Organizations should also consider disabling unnecessary TCP services and conducting comprehensive vulnerability assessments to identify any additional exposure points within their distributed computing environments that may amplify the impact of this vulnerability.