CVE-2026-60308: 
Oracle Coherence vulnerability analysis and mitigation

CVE-2026-60308 is a critical unauthenticated remote code execution vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. It affects versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability was disclosed on July 21, 2026, as part of Oracle's July 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 9.8 (Critical) (Oracle CPU Jul 2026).

The vulnerability resides in the Core component of Oracle Coherence and is exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges or user interaction (CWE classification not explicitly published by Oracle). The attack complexity is low, making it straightforward to exploit remotely. Oracle has not publicly disclosed the specific technical root cause or exploitation mechanism beyond the advisory description, and no public technical write-ups or proof-of-concept code have been identified at this time (Oracle CPU Jul 2026).

Successful exploitation can result in a complete takeover of the affected Oracle Coherence instance, with high impact to confidentiality, integrity, and availability. An unauthenticated remote attacker could potentially read sensitive cached data, modify or corrupt data managed by Coherence, and disrupt service availability. Given Coherence's role as a distributed in-memory data grid often integrated with enterprise middleware, compromise could facilitate lateral movement into connected Oracle Fusion Middleware components (Oracle CPU Jul 2026).

Oracle strongly recommends applying the patches released in the July 2026 Critical Patch Update as soon as possible. Affected versions are 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; customers should consult the Fusion Middleware patch availability documentation linked from the Oracle CPU advisory for specific patch identifiers and installation instructions. As a temporary risk reduction measure, Oracle suggests blocking network access (HTTP) to Oracle Coherence endpoints from untrusted networks, though this is not a permanent fix. Customers should also ensure they are running actively supported versions (Oracle CPU Jul 2026).

The vulnerability was noted by threat intelligence aggregators shortly after Oracle's July 2026 CPU release, with entries appearing on CVEFeed and VulDB within hours of disclosure. No significant independent researcher commentary, vendor statements beyond the Oracle advisory, or major media coverage has been identified at this time (Oracle CPU Jul 2026).