External risk intelligence

Oracle Coherence Network Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60234

Oracle Coherence is a distributed caching and data grid solution. While it requires network access and can be exposed, it is typically deployed as a backend component within internal application tiers rather than as a public-facing internet service. Although network reachability is possible, common deployment patterns place these services behind application servers or firewalls.

Missing Authentication

Oracle Coherence

12.2.1.4.014.1.1.0.014.1.2.0.015.1.1.0.0

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Coherence, a component within Oracle Fusion Middleware. This issue could allow an attacker, without needing any credentials, to gain full control of the Coherence system by exploiting network access. While the direct business impact requires confirmation of exposure, the severity of the vulnerability warrants attention.

Unauthenticated attackers can take over Oracle Coherence.
This is a critical, remotely exploitable system compromise.
Confirm if Oracle Coherence is deployed in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could compromise Oracle Coherence by reaching it over the network. Since this vulnerability is easily exploitable and does not require authentication, an attacker could potentially gain full control of the Coherence system.

Unauthenticated network access is required.
The vulnerability is triggered remotely.
Complete takeover of the system is possible.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access could compromise Oracle Coherence, potentially leading to a full takeover of the system. This vulnerability impacts confidentiality, integrity, and availability, meaning an attacker could access, modify, or disrupt sensitive data and services.

Oracle Coherence system data.
Via unauthenticated network access.
Complete system takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Oracle Coherence impacts Oracle Fusion Middleware and could lead to a full system takeover by an unauthenticated attacker. Responsibility for addressing this typically falls to application owners and infrastructure or platform teams who manage Oracle Coherence deployments. The immediate first step is to identify all instances of the affected technology, determine their reachability and business criticality, and then engage the accountable owner to plan remediation based on assessed risk.

Application or platform teams should own remediation.
Verify network exposure and business criticality first.
Plan coordinated updates during scheduled maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Coherence?

Oracle Coherence is a distributed caching and data grid software component used within Oracle Fusion Middleware. It helps applications manage and process massive amounts of data in real-time by keeping it in memory across multiple servers, which improves speed and scalability for enterprise-level applications.

What does CVE-2026-60234 mean for system security?

This vulnerability represents a significant security flaw that allows unauthorized individuals to bypass authentication mechanisms. Because the system fails to properly verify the identity of those connecting to it, a remote attacker can seize control of the Coherence instance, potentially reading, changing, or destroying the data it processes.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted network traffic directly to the Oracle Coherence component over TCP. It is important to note that this attack cannot be triggered by local actions alone; it requires successful network connectivity. If a system is completely isolated from the network, the specific path required to exploit this bug is blocked.

Who should be concerned about this threat?

Organizations using the affected Oracle Coherence versions should investigate their environment. According to Halo Surface Signal, while this service is often placed on internal tiers behind firewalls, any instance with reachable network paths is at risk. You should prioritize assessing systems that may be inadvertently exposed to broader network segments.

Do I need to update my software immediately?

The first step is to locate all instances of Oracle Coherence across your infrastructure to determine which ones are running the vulnerable versions. Once you have identified them, evaluate their network reachability and business role. Coordinate with your platform or application teams to schedule necessary updates during your next maintenance window.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.