External risk intelligence

Oracle Coherence Core Takeover Vulnerability CVE-2026-60278

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60278

Oracle Coherence is a middleware component typically used for caching and data grid services within enterprise backend architectures. While the vulnerability is reachable via HTTP, this product is generally deployed in internal network tiers rather than directly exposed to the public internet, though it is plausibly reachable in some specific deployment configurations.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Coherence, a component of Oracle Fusion Middleware. This issue could allow an unauthenticated attacker with network access to take complete control of the Coherence system, potentially impacting confidentiality, integrity, and availability of services. The primary concern is to confirm if our environment utilizes this specific Oracle product.

Unauthenticated attackers can fully control affected Oracle systems.
Understand exposure and confirm if Oracle Coherence is in use.
Assess relevance and potential impact within our specific deployments.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can target Oracle Coherence by sending network requests over HTTP. Exploiting this vulnerability could lead to a complete takeover of the Coherence system, impacting confidentiality, integrity, and availability.

Attacker must have network access.
Vulnerability is triggered via HTTP.
Risk is complete system takeover.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access via HTTP could compromise Oracle Coherence, potentially leading to the takeover of the service. This is supported by the advisory's description of an easily exploitable vulnerability with high impacts on confidentiality, integrity, and availability.

Oracle Coherence service data.
Unauthenticated network access to service.
Complete service takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for Oracle Fusion Middleware and its Coherence component, likely application owners and platform infrastructure teams, must first identify all deployments. Confirming reachability and business criticality for each instance will help prioritize remediation efforts and engage the accountable owner.

Application and platform teams own the issue.
Verify Coherence deployment reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Coherence?

Oracle Coherence is a middleware product within the Oracle Fusion Middleware family. It functions as an in-memory data grid that applications use to cache data and manage distributed information across clusters. Because it handles high-performance data processing, it is typically embedded deep within enterprise backend architectures to support scalable, real-time application performance.

What kind of vulnerability is CVE-2026-60278?

CVE-2026-60278 is a critical security flaw that allows an attacker to take full control of an Oracle Coherence instance. While the specific underlying weakness class is not detailed, the vulnerability acts as a gateway for unauthorized users to compromise the integrity, confidentiality, and availability of the system without needing any login credentials.

How is this Oracle Coherence vulnerability triggered?

The vulnerability is triggered when an attacker sends specific, unauthorized requests over HTTP to the Oracle Coherence component. It does not require the attacker to have pre-existing access, user accounts, or permissions. Conversely, the bug is not triggered by legitimate, authenticated operations performed by authorized users or standard internal system traffic.

Do I need to worry about CVE-2026-60278?

According to Halo Surface Signal, you should prioritize this if your Oracle Coherence instances are reachable via network paths that allow HTTP access. While this software is often located in secure internal network tiers, it is crucial to verify if your specific deployment configuration accidentally exposes the service, as internet-facing or poorly segmented instances face a much higher risk.

What are the first steps to address this issue?

Your immediate priority is to identify every instance of Oracle Coherence running within your environment. Once you have a complete inventory, verify the network reachability of each instance to determine if they are exposed to untrusted networks. After mapping these assets, work with your infrastructure teams to assess the business criticality of each deployment and prepare for applying security patches.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.