Executive brief
Oracle Coherence, a data grid solution used for high-speed data processing and application scaling, contains a vulnerability in its core component. An unauthenticated attacker could remotely exploit this flaw to gain full control over the Coherence environment. This could lead to the theft of sensitive cached data, unauthorized modification of information, or a complete shutdown of the service.
Technical details
A vulnerability exists in the Core component of Oracle Coherence (Fusion Middleware). The flaw is exploitable by an unauthenticated attacker with network access via the T3 or IIOP protocols. While the vulnerability is classified as difficult to exploit (High Attack Complexity), a successful attack results in a complete compromise of the Oracle Coherence instance, impacting confidentiality, integrity, and availability. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Users are advised to refer to the Oracle Critical Patch Update (CPU) for July 2026 for remediation steps.
Affected products
- Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
Timeline
- 2026-07-21: disclosed: Initial publication of CVE-2026-60222
- 2026-07-21: advisory: Oracle July 2026 Critical Patch Update released