CVE-2026-60235 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence as well as unauthorized update, insert or delete access to some of Oracle Coherence accessible data and unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Coherence, a distributed caching and processing platform that forms part of Oracle Fusion Middleware. The affected version 15.1.1.0.0 represents a critical security flaw that exposes the system to unauthenticated network-based attacks through TCP connections. The vulnerability's ease of exploitation means that attackers can leverage this weakness without requiring any authentication credentials or privileged access, making it particularly dangerous in environments where the service is accessible over networks.
The technical flaw stems from insufficient input validation and authentication mechanisms within the Coherence component, allowing malicious actors to send specially crafted network packets that trigger unexpected behavior in the system. This vulnerability operates at the network layer, meaning attackers can exploit it remotely without needing physical access to the system or prior authorization. The CVSS score of 8.6 indicates a high-severity risk with significant impacts across all three core security principles.
The operational impact of this vulnerability is severe and multifaceted, encompassing complete denial of service conditions that can cause the Coherence service to hang or crash repeatedly, effectively rendering the distributed caching system unusable. Additionally, successful exploitation grants attackers unauthorized capabilities to modify data within the system through update, insert, or delete operations, while also providing read access to sensitive information. This dual impact on both availability and data integrity creates a comprehensive security breach that can severely compromise the reliability and confidentiality of enterprise applications relying on Oracle Coherence for distributed data management.
From a cybersecurity framework perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and CWE-125 (Out-of-bounds Read) categories, representing weak access control mechanisms combined with potential buffer overflow conditions. The attack surface maps to several ATT&CK techniques including T1190 (Exploit Public-Facing Application) and T1499 (Endpoint Denial of Service), demonstrating how attackers can leverage this vulnerability to achieve both service disruption and data compromise. Organizations should immediately implement network segmentation controls, restrict TCP port access to trusted networks only, and apply Oracle's official security patches as soon as they become available.
Mitigation strategies must include immediate network-level restrictions using firewalls to limit access to Coherence ports, especially those used for cluster communication. System administrators should also consider implementing intrusion detection systems to monitor for suspicious TCP traffic patterns that might indicate exploitation attempts. The recommended approach involves applying Oracle's security patches and updates while maintaining comprehensive monitoring of the Coherence service logs for any unauthorized access attempts or abnormal operational behavior. Organizations relying on this technology should conduct thorough vulnerability assessments to identify all instances of the affected version and establish incident response procedures to address potential exploitation events.
The long-term security posture requires implementing proper network architecture principles such as zero trust models, where every connection attempt is verified regardless of origin, and regular security audits to ensure that access controls remain properly configured. Organizations should also consider migrating to supported versions of Oracle Coherence that have addressed these vulnerabilities and implement additional monitoring solutions to detect anomalous behavior patterns that could indicate exploitation attempts against similar weaknesses in other enterprise systems.