CVE-2026-60305: 
Oracle Coherence vulnerability analysis and mitigation

CVE-2026-60305 is a vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability is easily exploitable by a low-privileged attacker with network access via TCP, allowing unauthorized data manipulation and limited data exposure. It was disclosed on July 21, 2026, as part of Oracle's July 2026 Critical Patch Update, with a CVSS v3.1 base score of 7.1 (High) (Oracle CPU Jul 2026).

The vulnerability resides in the Core component of Oracle Coherence and is exploitable over TCP by a low-privileged, authenticated network attacker with no user interaction required (CWE classification not explicitly specified by Oracle). The attack complexity is low, and the scope is unchanged, meaning exploitation is confined to the Coherence instance itself. Oracle has not publicly disclosed the precise root cause or technical mechanics beyond the risk matrix description, and no public proof-of-concept code has been identified at this time (Oracle CPU Jul 2026).

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all Oracle Coherence accessible data (high integrity impact), as well as unauthorized read access to a subset of Oracle Coherence accessible data (low confidentiality impact). Availability is not impacted. Given that Oracle Coherence is a distributed in-memory data grid often used in enterprise middleware environments, compromise could affect business-critical cached data and potentially facilitate further attacks on dependent applications (Oracle CPU Jul 2026).

Oracle strongly recommends applying the patches released as part of the July 2026 Critical Patch Update for Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. As a temporary risk reduction measure, Oracle suggests blocking TCP network access to Oracle Coherence from untrusted or unnecessary network sources, and restricting low-privileged user accounts to only those who require access. These workarounds do not address the underlying vulnerability and patching remains the recommended long-term solution (Oracle CPU Jul 2026).