External risk intelligence

Oracle Coherence Core Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60209

Oracle Coherence is a distributed data grid used for application clustering and data caching. While it is network-accessible, it is typically deployed in internal application tiers or private backend clusters rather than directly exposed to the public internet, though it may be reachable in some misconfigured or specific enterprise network architectures.

Missing Authentication

Oracle Coherence

12.2.1.4.014.1.1.0.014.1.2.0.015.1.1.0.0

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Coherence, a component within Oracle Fusion Middleware. This issue, if exploited by an unauthenticated attacker, could lead to a complete takeover of the Coherence environment, impacting confidentiality, integrity, and availability. The main concern at this stage is confirming if our specific deployment is relevant and potentially exposed.

Unauthenticated attackers can take over Oracle Coherence.
Protects core business application data and services.
Confirm relevance and potential exposure to Oracle Coherence.

Attack Path

How an attacker could exploit the issue

An attacker can compromise Oracle Coherence by sending specially crafted network traffic. Because this vulnerability is easily exploitable and does not require authentication, an attacker with network access can trigger it and gain full control over the affected Oracle Coherence system.

Attacker needs network access.
Triggered by unauthenticated network traffic.
Results in takeover of the system.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access via TCP could compromise Oracle Coherence, potentially leading to a full takeover of the system. This is supported when the product is accessible over the network.

System data and service behavior at risk.
Unauthenticated network access can lead to exposure.
Complete system takeover is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this vulnerability in Oracle Coherence, given its role in application clustering and data caching. The first practical step is to identify all instances of Oracle Coherence within your environment, confirm their network accessibility and business criticality, and then assign ownership for remediation planning.

Accountable team: Application or infrastructure owners.
Verify: Oracle Coherence instances and exposure.
Action: Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Coherence?

Oracle Coherence is a distributed data grid solution that serves as a caching and clustering layer for enterprise applications. It allows systems to store, manage, and process data across multiple servers in real-time, helping to improve application performance, scalability, and availability for mission-critical business services.

How does CVE-2026-60209 impact Oracle Coherence?

This vulnerability represents a significant security weakness that allows an unauthorized party to gain full control over the Coherence system. By successfully sending specially crafted network traffic, an attacker can compromise the environment, potentially impacting the confidentiality, integrity, and availability of the data and services it manages.

Do I need to be authenticated to trigger CVE-2026-60209?

No, authentication is not required to trigger this vulnerability. An attacker only needs network access to the target system via TCP to initiate the exploit. If the Oracle Coherence service is not reachable over the network—for instance, if it is strictly segmented or firewalled from untrusted traffic—the trigger condition cannot be met.

Is my Oracle Coherence instance at risk?

According to Halo Surface Signal, Oracle Coherence is typically deployed in internal application tiers rather than directly on the public internet. However, your risk depends on your specific network architecture. You should evaluate if your instances are accessible across network boundaries or within environments where internal traffic is not sufficiently restricted.

What steps should I take if I use this software?

Begin by auditing your infrastructure to locate all instances of Oracle Coherence across your environment. Once identified, assess the network accessibility of each instance to determine which systems are potentially reachable. Use this information to prioritize your remediation planning and coordinate with the infrastructure or application teams responsible for those specific deployments.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.