CVE-2026-60309: 
Oracle Coherence vulnerability analysis and mitigation

CVE-2026-60309 is a vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows an unauthenticated attacker with access to the physical communication segment (adjacent network) where Oracle Coherence executes to fully compromise the product. It was disclosed on July 21, 2026, as part of Oracle's Critical Patch Update for July 2026, and carries a CVSS v3.1 base score of 8.8 (High) (Oracle CPU Jul 2026).

The vulnerability resides in the Core component of Oracle Coherence and is exploitable by an unauthenticated attacker positioned on the same physical network segment as the affected host (attack vector: Adjacent Network). The low attack complexity and absence of required privileges or user interaction indicate the flaw is straightforward to exploit once network adjacency is achieved. No specific CWE classification or detailed technical write-up has been publicly released at this time, as Oracle does not disclose detailed vulnerability analysis in its Critical Patch Update advisories (Oracle CPU Jul 2026).

Successful exploitation results in a full takeover of the affected Oracle Coherence instance, with high impacts to confidentiality, integrity, and availability. An attacker could read sensitive cached data, manipulate or corrupt data within the Coherence cluster, and disrupt service availability. Given Coherence's role as a distributed in-memory data grid often used in enterprise middleware environments, compromise could facilitate lateral movement to connected application tiers (Oracle CPU Jul 2026).

Oracle has addressed this vulnerability in the July 2026 Critical Patch Update. Affected users should apply the patches provided for Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 as soon as possible. As a temporary measure, Oracle recommends blocking network protocols required by the attack at the network perimeter to reduce exposure, though this is not a permanent fix. Organizations should also restrict access to the network segment where Oracle Coherence operates to trusted hosts only (Oracle CPU Jul 2026).