External risk intelligence

Oracle Coherence Core Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60226

Oracle Coherence is a distributed caching and data grid solution typically deployed in back-end infrastructure or internal application tiers. While it utilizes TCP network access, it is generally not designed to be exposed directly to the public internet, usually operating behind application servers or within isolated cluster environments.

Oracle Coherence

12.2.1.4.014.1.1.0.014.1.2.0.015.1.1.0.0

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Coherence, a component within Oracle Fusion Middleware, that could allow an unauthenticated attacker to gain complete control of the system. This issue impacts supported versions and, due to its network accessibility and ease of exploitation, represents a significant security concern requiring careful assessment of its relevance to our environment.

Unauthenticated attackers can fully control affected Oracle Coherence systems.
Leadership should remember this to understand potential system compromise risks.
Confirm relevance and exposure to Oracle Coherence deployments.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending network requests over TCP to Oracle Coherence. If successful, this could allow the attacker to take over the vulnerable component.

Network access via TCP required.
Unauthenticated attacker triggers vulnerability.
Full takeover of Oracle Coherence possible.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access could compromise Oracle Coherence, potentially leading to a complete takeover of the system. This could affect the confidentiality, integrity, and availability of data managed by Oracle Coherence.

System data and service integrity at risk.
Via network access, unauthenticated attacker.
Full takeover of Oracle Coherence.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Oracle Coherence, a distributed caching and data grid solution, is likely to be managed by infrastructure, platform, or security teams, depending on the deployment model and how the technology is integrated into the broader environment. The immediate priority is to identify all instances of the affected product, assess their reachability and business criticality, and locate the accountable owners to prioritize remediation efforts.

Ownership: Infrastructure and platform teams.
Verify first: Network reachability and business impact.
Action: Plan risk-based remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Coherence?

Oracle Coherence is a middleware component used for distributed caching and data grid management. It allows applications to store and manage data across multiple servers, helping systems handle large volumes of information and improve performance in enterprise computing environments.

What does CVE-2026-60226 mean for security?

This vulnerability represents a flaw where the system fails to properly validate inputs or access, allowing an unauthorized person to execute commands. Because it allows a complete takeover of the component, it is classified as a critical risk to the confidentiality, integrity, and availability of the data stored within the cache.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending malicious network requests over TCP directly to the Oracle Coherence component. It does not require valid login credentials or prior access. Note that simply interacting with an application that uses Coherence as a backend is not the same as having the direct TCP network access required to exploit this specific flaw.

Is my Oracle Coherence deployment at high risk?

Risk depends heavily on how your system is positioned. According to Halo Surface Signal, Coherence is typically used in internal back-end tiers and is not designed for direct exposure to the public internet. If your specific instance is isolated from the internet and protected by internal network segmentation, the likelihood of a remote attacker reaching the service is significantly reduced.

What should I do to respond to this vulnerability?

Your first step is to locate all instances of Oracle Coherence across your infrastructure. Work with your platform or infrastructure teams to determine if any nodes are reachable over the network from untrusted zones. Once identified, prioritize these systems for security updates provided by the vendor, as this is the primary way to remove the underlying vulnerability.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.