CVE-2026-60309 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Coherence executes to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
Oracle Coherence represents a distributed caching and processing platform that forms a critical component within Oracle Fusion Middleware environments, serving as the backbone for enterprise-scale data management and application coordination. This vulnerability exists within the core communication protocols of the software, specifically targeting the network-level authentication mechanisms that govern how nodes communicate within the distributed system. The affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 all share a common flaw in their network security implementation that creates an exploitable entry point for malicious actors.
The technical nature of this vulnerability stems from insufficient authentication controls within the Oracle Coherence communication stack, allowing attackers to perform man-in-the-middle attacks or packet manipulation on the physical network segment where the system operates. This weakness manifests as a failure to properly validate incoming network traffic, enabling unauthenticated entities to inject malicious payloads that can compromise the integrity and availability of the entire distributed caching infrastructure. The vulnerability's classification as easily exploitable indicates that minimal technical expertise is required to leverage this flaw effectively, making it particularly dangerous in production environments where such systems are often exposed to untrusted network segments.
The operational impact of successful exploitation extends beyond simple data compromise, as attackers can achieve complete system takeover of the Oracle Coherence instances. This level of access enables threat actors to manipulate cached data, disrupt service availability, and potentially pivot to other systems within the enterprise network that may be connected to the same communication infrastructure. The CVSS 3.1 score of 8.8 reflects the severity of this vulnerability across all three core security principles, with high impact scores for confidentiality, integrity, and availability. The attack vector AV:A indicates that physical network access is required, while the low access complexity AC:L suggests that once inside the network segment, exploitation becomes straightforward.
From a threat modeling perspective, this vulnerability maps directly to several ATT&CK techniques including T1046 Network Service Scanning and T1566 Phishing, as attackers may need to first identify vulnerable systems before exploiting this weakness. The CWE classification for this vulnerability would likely fall under CWE-287 Improper Authentication, specifically addressing the failure to properly authenticate network communications within distributed systems. Organizations utilizing Oracle Coherence should immediately implement network segmentation controls and consider deploying intrusion detection systems to monitor for suspicious traffic patterns that may indicate exploitation attempts.
Mitigation strategies must address both immediate operational concerns and long-term architectural improvements. Network-level protections including firewall rules, VLAN segmentation, and mandatory access controls should be implemented to restrict direct communication between Coherence nodes and untrusted networks. The implementation of secure communication protocols such as TLS encryption for all inter-node communications provides an additional layer of protection against man-in-the-middle attacks. Regular vulnerability assessments and penetration testing should be conducted to identify similar weaknesses in related components of the Oracle Fusion Middleware stack, while system administrators must maintain current patches and updates to address known vulnerabilities. The affected versions should be prioritized for immediate upgrade or patching, as this vulnerability represents a critical risk that can lead to complete system compromise without proper defenses in place.