← News
/DISPATCH · 2026-07-31

CVE-2026-60217: Oracle Coherence Unauthenticated TCP Takeover Vulnerability (CVSS 10.0)

Oracle Coherence in-memory data grid has a CVSS 10.0 flaw. Unauthenticated attackers can fully take over the cluster over TCP, hitting core infrastructure of enterprise Java apps.

Incident Overview

Oracle's July CPU disclosed CVE-2026-60217, a critical flaw in the Oracle Coherence in-memory data grid. CVSS is 10.0. No auth required. An attacker can fully take over a Coherence cluster over TCP and hit every enterprise Java app that depends on it.

Technical Details

Root Cause

The bug is in the Coherence Core TCP endpoint. No authentication. Exploitation looks like this:

Affected Versions

Impact Assessment

Metric | Rating

CVSS 3.1 Base Score | 10.0 (Critical)

Attack Vector | Network (AV:N)

Attack Complexity | Low (AC:L)

Privileges Required | None (PR:N)

User Interaction | None (UI:N)

Scope | Changed (S:C)

Coherence is an enterprise distributed cache used in Java application clusters across finance, telecom, e-commerce, and other critical industries. Successful exploit can yield:

Remediation

Immediate Actions

Detection Indicators

`# Check Coherence log anomalies
grep -i "error\\|exception\\|unauthorized" \\
    /path/to/coherence/logs/coherence.log

# Monitor unexpected TCP connections
netstat -an | grep -E "7574|7575" | grep -v "known cluster IPs"`

References