CVE-2026-60308: 
Oracle Coherence vulnerability analysis and mitigation

CVE-2026-60308 is a critical missing authentication vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. It affects versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows an unauthenticated remote attacker with network access via HTTP to fully compromise the affected Oracle Coherence instance. It was published on July 21, 2026, and patched as part of Oracle's July 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 9.8 (Critical) (Oracle CPU Jul 2026).

The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function), meaning a critical HTTP-accessible function within Oracle Coherence's Core component can be reached and abused without any authentication. The attack vector is network-based, requires no privileges, no user interaction, and has low attack complexity, making it trivially automatable. The NVD SSVC assessment confirms the vulnerability is automatable with total technical impact. No detailed technical write-ups or public proof-of-concept code have been identified at this time (Oracle CPU Jul 2026).

Successful exploitation results in a complete takeover of the Oracle Coherence instance, with high impact to confidentiality, integrity, and availability. An unauthenticated attacker can read sensitive cached data, modify system configuration and data stored within the Coherence cluster, and disrupt service availability. Given Oracle Coherence's role as a distributed in-memory data grid often used in enterprise middleware environments, compromise could facilitate lateral movement to connected application tiers or backend systems (Oracle CPU Jul 2026).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of this report. The EPSS score is approximately 0.395%, indicating a currently low but non-negligible probability of exploitation in the near term. The NVD SSVC assessment classifies the vulnerability as automatable with no known active exploitation. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution is available (Oracle CPU Jul 2026).

1. Reconnaissance: Identify internet-facing or network-accessible Oracle Coherence instances running versions 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 using network scanning tools (e.g., Shodan, Censys, or Nmap targeting default Coherence HTTP management ports).
2. Identify vulnerable endpoint: Locate the unauthenticated HTTP endpoint exposed by Oracle Coherence's Core component that lacks proper authentication controls.
3. Send unauthenticated HTTP request: Craft and send an HTTP request directly to the vulnerable endpoint without supplying any credentials or session tokens, exploiting the missing authentication for the critical function.
4. Achieve system takeover: Leverage the unauthenticated access to read sensitive data from the Coherence cache, modify cluster configuration or data, or disrupt service availability — potentially pivoting to connected application servers or backend systems.

• Network: Unexpected or anomalous HTTP requests to Oracle Coherence management or cluster communication ports (e.g., default ports 7001, 9000, or custom HTTP management ports) from unauthorized source IPs; unusual volume of unauthenticated HTTP requests to Coherence endpoints.
• Logs: Oracle Coherence access logs showing HTTP requests to sensitive management endpoints without authentication headers or session tokens; repeated access from unfamiliar IP addresses.
• Process/Behavior: Unexpected changes to Coherence cluster configuration or cache data; unusual data exfiltration patterns from the Coherence cluster; service disruptions or unexpected restarts of Coherence cluster members.

Oracle has released patches for CVE-2026-60308 as part of the July 2026 Critical Patch Update (CPU). Administrators should apply the relevant patches for Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 immediately. As a temporary workaround prior to patching, restrict network access to Oracle Coherence HTTP endpoints using firewalls or network-level controls, allowing only authorized clients and networks to reach the service. Oracle strongly recommends applying the CPU patches as soon as possible rather than relying on network-level mitigations as a long-term solution (Oracle CPU Jul 2026).