Oracle Coherence CVE-2026-60285

Oracle Coherence versions 12.2.1.4.0 through 15.1.1.0.0 contain a critical unauthenticated remote code execution vulnerability (CVSS 9.8) enabling complete system takeover through network access; no public exploit is identified at time of analysis, but the easily exploitable nature means organizational risk is immediate. No vendor patch is currently available, creating an extended window of vulnerability. All organizations running these versions face potential complete compromise of data confidentiality, integrity, and availability, requiring urgent interim containment measures.

Within 24 hours: Identify all systems running Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and implement firewall rules to restrict inbound TCP access to Coherence nodes from untrusted networks. Within 7 days: Deploy endpoint monitoring and SIEM detection rules for Coherence cluster access attempts; establish baseline traffic profiles; request patch timeline and temporary mitigations from Oracle support. Within 30 days: Upon vendor patch release, execute phased deployment to test environments followed by monitored production rollout of the patched version, prioritizing critical systems.

Network segmentation restricting Coherence access to known trusted cluster members only; firewall allow-lists limiting inbound connectivity to Coherence default ports (9000 range); disabling unnecessary remote administration and JMX access if operationally feasible; intrusion detection system (IDS) monitoring for exploitation attempts; detailed connection logging for forensic review; incident response runbooks specific to Coherence compromise scenarios.