CVE-2026-60257

Received Received - Intake

Oracle Coherence Remote Code Execution Vulnerability

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Oracle

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-60257

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	coherence	14.1.1.0.0
oracle	coherence	14.1.2.0.0
oracle	coherence	15.1.1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a critical vulnerability in Oracle Coherence, a middleware product. It allows an unauthenticated attacker to remotely access and take over the system via network TCP connections. The flaw affects versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of Oracle Coherence running on your network. Use network scanning tools like Nmap to identify systems with open TCP ports commonly used by Oracle Coherence (default ports include 7574, 8080, or custom ports). Check running processes on systems using commands like 'ps -ef | grep coherence' on Unix/Linux or 'Get-Process' in PowerShell on Windows. Verify installed versions by examining Oracle Coherence installation directories or configuration files for version details.

Impact Analysis

An attacker could exploit this to fully compromise Oracle Coherence, leading to loss of confidentiality, integrity, and availability of data processed by the system. This may result in data breaches, unauthorized access, or service disruption.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations due to unauthorized data access or loss. Organizations using affected versions may face legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately apply the latest Oracle Critical Patch Update for Oracle Coherence to address this vulnerability. If patching is not immediately possible, isolate affected systems by blocking TCP ports used by Oracle Coherence at the network firewall level. Disable or restrict access to Oracle Coherence services until patches are applied. Monitor Oracle's security advisories for updates and apply them promptly.

Hi! I’m here to help you understand CVE-2026-60257. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70