CVE-2026-60306: 
Oracle Coherence vulnerability analysis and mitigation

CVE-2026-60306 is a Missing Authentication for Critical Function vulnerability (CWE-306) in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows an unauthenticated remote attacker with network access via TCP to fully compromise the affected Oracle Coherence instance. It was published on July 21, 2026, and addressed in Oracle's Critical Patch Update for July 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (Oracle CPU Jul2026).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function), meaning critical operations within Oracle Coherence's Core component can be accessed without any authentication. An unauthenticated attacker with network access via TCP can send crafted requests to the Coherence service, bypassing authentication controls entirely. No user interaction or special privileges are required, and the attack complexity is low, making this trivially exploitable from any network-accessible position. No public technical write-ups or proof-of-concept code have been identified at this time (Oracle CPU Jul2026).

Successful exploitation results in a complete takeover of the Oracle Coherence instance, with high impact to confidentiality, integrity, and availability. An attacker can execute arbitrary code, read and modify all data managed by the Coherence service, and disrupt its availability. Given Coherence's role as a distributed in-memory data grid often used in enterprise middleware environments, compromise could facilitate lateral movement to connected systems and exposure of sensitive application data (Oracle CPU Jul2026).

As of the time of publication, there is no evidence of a public proof-of-concept exploit or active in-the-wild exploitation of CVE-2026-60306. The vulnerability is classified as automatable (no user interaction required) with a network attack vector and low complexity, making it highly amenable to automated scanning and exploitation if a PoC becomes available. The EPSS score is approximately 0.395%, indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time (Oracle CPU Jul2026).

Oracle has released patches for CVE-2026-60306 as part of the July 2026 Critical Patch Update (CPUJul2026). Administrators should apply the relevant patches for their affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0) immediately. As a temporary workaround until patching is feasible, restrict network access to Oracle Coherence instances to only trusted hosts and implement network segmentation to limit TCP exposure of vulnerable services. Oracle strongly recommends against relying on network-level controls as a long-term solution (Oracle CPU Jul2026).