CVE-2026-60307 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Coherence, a distributed computing platform that forms part of Oracle Fusion Middleware, specifically targeting the Core component. The affected versions span across multiple release lines including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, indicating a widespread issue affecting the product's core functionality. The vulnerability operates at the network level through HTTP protocol access, making it particularly concerning as it requires minimal privileges to exploit while still allowing unauthorized data access. This represents a significant security gap in Oracle's distributed caching infrastructure that could potentially expose sensitive operational data.
The technical flaw manifests as an insufficient authorization mechanism within the Coherence service architecture, allowing attackers with basic network connectivity and low privilege credentials to bypass normal access controls. The vulnerability's CVSS score of 4.3 reflects its moderate severity, specifically targeting confidentiality impacts with a low attack complexity and requiring only low privileges for exploitation. The vector indicates that no user interaction is necessary for exploitation, and the attack can occur across a network without requiring physical access or specialized tools. This suggests the flaw exists in how the system validates authentication and authorization requests when processing HTTP-based communication.
The operational impact of this vulnerability extends beyond simple data exposure as it compromises the integrity of Oracle Coherence's distributed data management system. Attackers could potentially access sensitive configuration data, user information, or application-specific cache contents that might reveal business-critical details or operational patterns. The subset access nature implies that while not all data may be compromised, sufficient information could be obtained to facilitate more sophisticated attacks or to understand system architecture and operational procedures. This vulnerability aligns with CWE-284 which addresses improper access control issues in software systems.
Organizations utilizing affected Oracle Coherence versions face significant risk of unauthorized data disclosure, particularly in environments where sensitive business information is stored in distributed caches. The attack vector through HTTP makes this vulnerability particularly dangerous as it can be exploited from external networks without requiring specialized network penetration tools. Security teams should consider implementing network segmentation and access controls to limit exposure while applying vendor patches and updates. The vulnerability demonstrates weaknesses in Oracle's implementation of authorization mechanisms within its middleware products, potentially affecting organizations that rely on Coherence for enterprise-scale data distribution and caching operations.
From a defensive perspective, administrators should prioritize patch management activities and implement network monitoring solutions to detect unusual HTTP traffic patterns that might indicate exploitation attempts. The vulnerability highlights the importance of maintaining up-to-date security patches across all middleware components in enterprise environments. Organizations may also need to consider implementing additional authentication layers or access controls specifically targeting Coherence services to reduce the impact of such authorization bypass issues. This case study exemplifies how distributed computing platforms can contain critical vulnerabilities that affect data confidentiality and require immediate attention from security operations teams.