Oracle Coherence CVE-2026-60255

Oracle Coherence in Oracle Fusion Middleware is vulnerable to remote unauthenticated attacks that can cause service crashes and unauthorized data modification by any attacker with network access. Organizations relying on Coherence for in-memory data caching face operational disruption and data integrity compromise risks. No vendor patch is currently available, requiring immediate network containment to protect business continuity.

Within 24 hours, inventory all Coherence instances in your Oracle Fusion Middleware environment and restrict TCP access to Coherence ports (typically 9000-9100) to authorized internal networks only via firewall rules or network segmentation. Within 7 days, coordinate with Oracle support to identify available workarounds or hardening configurations, and document the business criticality and data sensitivity of each Coherence deployment. Within 30 days, deploy intrusion detection signatures for CVE-2026-60255 exploitation attempts; maintain active monitoring of Oracle security advisories for patch release; establish rapid deployment procedures for patching once vendor releases a fix.

No vendor-released patch identified at time of analysis. Interim mitigations: implement network access controls restricting Coherence TCP ports to trusted internal networks only; disable unnecessary Coherence services where operationally feasible; enable comprehensive logging and monitoring on all Coherence nodes to detect unauthorized connection attempts; segment Coherence infrastructure from external networks and untrusted internal segments.