External risk intelligence

Oracle Coherence Core Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60219

Oracle Coherence is typically used as an internal-facing data grid or caching layer within enterprise applications. While the vulnerability is reachable over a network via TCP without authentication, these components are generally deployed in isolated or private backend environments rather than being exposed directly to the public internet.

Missing Authentication

Oracle Coherence

12.2.1.4.014.1.1.0.014.1.2.0.015.1.1.0.0

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Coherence, a component within Oracle Fusion Middleware. This issue could allow an unauthorized external attacker to gain complete control of the Coherence system, potentially impacting data confidentiality, integrity, and availability due to its high CVSS score of 9.8. While the vulnerability is network-accessible, Oracle Coherence is typically deployed internally. The primary concern is to confirm if this technology is in use and assess potential exposure.

Unauthenticated network access can fully compromise Oracle Coherence.
High impact on data and system availability.
Confirm relevance and scope if Oracle Coherence is used.

Attack Path

How an attacker could exploit the issue

An attacker can target Oracle Coherence by sending malicious network traffic over TCP. This vulnerability is easily exploitable by an unauthenticated attacker with network access. A successful attack can lead to a complete takeover of the Oracle Coherence system.

No authentication needed.
Triggered by network access via TCP.
Risk of system takeover.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access could compromise Oracle Coherence, potentially leading to a complete takeover of the system. This could affect the confidentiality, integrity, and availability of data managed by Oracle Coherence.

Oracle Coherence system data.
Unauthenticated network access.
Complete system takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure or platform teams are likely responsible for addressing this vulnerability in Oracle Coherence. The first practical step is to identify all instances of the affected technology, confirm their network reachability and business criticality, and then locate the accountable owner to plan remediation based on the assessed risk.

Application or platform teams own the issue.
Verify Oracle Coherence network exposure and criticality.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Coherence?

Oracle Coherence is a data grid solution within Oracle Fusion Middleware. It provides distributed caching and data management, helping enterprise applications handle large volumes of information and scale efficiently across clustered environments.

How does CVE-2026-60219 affect Oracle Coherence?

This vulnerability represents a critical security weakness that allows an unauthenticated attacker to gain full control over the system. It enables unauthorized individuals to compromise the integrity, confidentiality, and availability of the data managed by the Core component.

Do I need authentication for an attack to trigger this?

No, authentication is not required. The vulnerability is triggered when an attacker sends specifically crafted malicious traffic to the service over TCP. It cannot be triggered by standard, authorized application traffic or local system operations that do not involve network-based interaction.

Why should I care about this if my systems are internal?

According to Halo Surface Signal, Oracle Coherence is typically used as a backend caching layer in private environments. However, because the vulnerability is reachable over any network via TCP, you must still assess if your specific deployment is accidentally accessible beyond your intended internal boundaries.

What are the first steps to address this vulnerability?

Begin by inventorying your environment to locate all instances of Oracle Coherence and confirm which versions are running. Once identified, evaluate the network accessibility and business criticality of those systems to help your team prioritize and plan remediation steps.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.