CVE-2026-60307: 
Oracle Coherence vulnerability analysis and mitigation

CVE-2026-60307 is an information disclosure vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows a low-privileged attacker with network access via HTTP to gain unauthorized read access to a subset of Oracle Coherence accessible data. It was published on July 21, 2026, and addressed in Oracle's July 2026 Critical Patch Update (CPU). It carries a CVSS v3.1 base score of 4.3 (Medium) (Oracle CPU July 2026).

The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the Oracle Coherence Core component improperly exposes data to actors without proper authorization. Exploitation requires only low privileges and network access via HTTP, with no user interaction or elevated attack complexity needed. No detailed technical write-ups or public proof-of-concept code have been identified at this time (Oracle CPU July 2026).

Successful exploitation results in unauthorized read access to a subset of data accessible within the Oracle Coherence environment, impacting confidentiality only — there is no integrity or availability impact. The scope is limited to the affected Coherence instance, with no evidence of lateral movement potential or broader system compromise based on current information. The data exposure risk is partial, as only a subset of Coherence-accessible data may be disclosed (Oracle CPU July 2026).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been observed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.0023 (0.23%), indicating a low probability of exploitation in the near term. Oracle's own assessment notes the exploitation status as "none" at this time (Oracle CPU July 2026).

Oracle has addressed this vulnerability in the July 2026 Critical Patch Update (CPU). Organizations should apply the relevant patches for their affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0) as soon as possible. As interim mitigations, restrict network access to Oracle Coherence services to only authorized users and networks, and implement network segmentation to limit exposure of Coherence instances. Oracle strongly recommends against relying on network-level workarounds as a long-term solution (Oracle CPU July 2026).