Oracle Coherence CVE-2026-60227

Oracle Coherence in-memory data grids can be completely compromised by unauthenticated remote attackers with only network access (CVE-2026-60227, CVSS 9.8), risking total loss of confidentiality, integrity, and availability for applications relying on this Fusion Middleware component. Organizations using Coherence face immediate exposure, as the vulnerability is easily exploitable and patching is not yet available.

Within 24 hours: Identify all systems running Oracle Coherence and map their network accessibility from untrusted zones; review access and authentication logs for suspicious connection attempts to Coherence ports. Within 7 days: Deploy network segmentation and firewall rules restricting TCP access to Coherence instances to only authorized internal systems; disable or isolate non-production Coherence deployments where possible. Within 30 days: Continuously monitor Oracle security advisories for patch availability; test patching procedures in a staging environment; prepare for immediate production deployment upon vendor patch release; conduct forensic analysis of network traffic and logs for evidence of exploitation attempts.

No vendor-released patch identified at time of analysis. Interim mitigations: implement firewall allowlists and network segmentation to restrict TCP access to Coherence instances; disable or isolate non-critical Coherence clusters; enable comprehensive logging and alerting for connection attempts to affected systems; establish rapid patching procedures and pre-stage patches in staging environments for immediate deployment; evaluate temporary failover to non-Coherence-dependent caching mechanisms if operationally feasible.