CVE-2026-60282 Oracle CVE debrief

Who should care

Organizations using Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 should prioritize patching this vulnerability to prevent potential data breaches and unauthorized access. Security teams, vulnerability management teams, and operators of affected systems should review and act on this vulnerability.

Technical summary

The CVE-2026-60282 vulnerability is a medium-severity issue affecting Oracle Coherence, a product of Oracle Fusion Middleware. The vulnerability is located in the Core component and has a CVSS score of 5.4. It allows a low-privileged attacker with network access via TCP to compromise Oracle Coherence, potentially leading to unauthorized data access and modification. Organizations should review their deployments and apply patches or mitigations as necessary to prevent potential data breaches and unauthorized access. Security teams, vulnerability management teams, and operators of affected systems should review and act on this vulnerability. The affected product deployments exist in managed environments and should be verified by defenders. The official advisory or CVE record should be reviewed to validate affected scope, severity, and vendor guidance.

Defensive priority

Medium priority given the CVSS score of 5.4 and the potential for unauthorized update, insert or delete access to some Oracle Coherence accessible data as well as unauthorized read access to a subset of Oracle Coherence accessible data.

Recommended defensive actions

• Inventory and verify affected Oracle Coherence versions
• Apply vendor patches or updates
• Implement compensating controls to restrict network access
• Monitor for suspicious activity
• Review and update security configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-60282 vulnerability affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It allows a low-privileged attacker with network access via TCP to compromise Oracle Coherence, potentially leading to unauthorized data access and modification. Defenders should verify affected product deployments and review official advisories for mitigation guidance.

Official resources