CVE-2026-60309: 
Oracle Coherence vulnerability analysis and mitigation

CVE-2026-60309 is an Improper Access Control vulnerability (CWE-284) in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability was disclosed on July 21, 2026, as part of Oracle's Critical Patch Update for July 2026. It carries a CVSS v3.1 base score of 8.8 (High), requiring only adjacent network access with no privileges or user interaction needed (Oracle CPU Jul 2026).

The vulnerability is classified under CWE-284 (Improper Access Control), with an estimated association to CWE-269 (Improper Privilege Management). An unauthenticated attacker with access to the physical communication segment attached to the hardware where Oracle Coherence executes can exploit this flaw to compromise the system. The attack vector is adjacent network (AV:A), meaning the attacker must be on the same physical or logical network segment as the target — such as a local LAN or VLAN — but no credentials or user interaction are required. No public proof-of-concept or detailed technical write-up has been disclosed at this time (Oracle CPU Jul 2026).

Successful exploitation results in a complete takeover of the affected Oracle Coherence instance, with high impact to confidentiality, integrity, and availability. An attacker could read sensitive cached data, modify system configurations and data stored within Coherence, and disrupt service availability. Given Coherence's role as a distributed in-memory data grid often used in enterprise middleware environments, compromise could facilitate lateral movement to dependent applications and services (Oracle CPU Jul 2026).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.0025 (0.25%), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment classifies exploitation as "none" and notes the vulnerability is not automatable due to the adjacent network access requirement (Oracle CPU Jul 2026).

Oracle has released patches for all affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0) as part of the July 2026 Critical Patch Update. Oracle strongly recommends applying these patches as soon as possible. As a temporary workaround, organizations should restrict physical and logical network access to the communication segment where Coherence nodes operate, implement network segmentation (e.g., VLANs, firewalls), and enforce strict access controls to limit which systems can communicate with Coherence cluster members. Oracle notes that network-level blocking may break application functionality and should not be considered a long-term solution (Oracle CPU Jul 2026).