CVE-2026-60243
Summary
by MITRE • 07/21/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability resides within Oracle Coherence, a distributed computing platform that forms part of Oracle Fusion Middleware, specifically targeting the Core component. The affected versions span across multiple release lines including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, indicating a widespread impact across the product lifecycle. The vulnerability is classified as easily exploitable, meaning that attackers with minimal technical expertise can leverage it effectively. The attack vector requires network access via TCP protocol, making it accessible to remote threat actors who can potentially compromise the system from outside the organization's network perimeter.
The technical flaw manifests as a weakness in the Coherence component's handling of incoming network requests, which allows for unauthorized manipulation that results in complete denial of service conditions. When exploited successfully, the vulnerability enables attackers to either cause the Oracle Coherence system to hang indefinitely or trigger frequently repeatable crashes that can be systematically reproduced. This behavior fundamentally undermines the availability aspect of the system's security posture, as the distributed computing infrastructure becomes completely non-operational and unable to serve its intended purpose. The CVSS 3.1 scoring system assigns a base score of 6.5, which represents a medium to high severity impact with availability being the primary concern.
From an operational perspective, this vulnerability poses significant risk to organizations relying on Oracle Coherence for critical distributed computing operations. The complete denial of service capability means that business-critical applications depending on Coherence's caching and data distribution services could experience extended downtime, potentially resulting in substantial financial losses and operational disruption. The low privilege requirement for exploitation means that even attackers with minimal access rights can cause catastrophic system failures, making this vulnerability particularly dangerous in environments where network exposure is unavoidable. This aligns with CWE-400 vulnerability classification related to unspecified resource management issues.
The attack surface for this vulnerability is particularly concerning given that it requires only network connectivity via TCP protocol, which is typically exposed through standard firewall configurations and application deployment patterns. Organizations should consider implementing network segmentation and access controls to limit exposure to authorized networks only. Security teams must prioritize patching efforts across all affected versions as the vulnerability can be exploited by threat actors with minimal technical expertise. Mitigation strategies should include monitoring for anomalous network traffic patterns that could indicate exploitation attempts, along with implementing robust network access controls and regular vulnerability assessments.
This vulnerability demonstrates the importance of maintaining up-to-date security patches for distributed computing frameworks, as the availability impact can completely disable critical infrastructure components. The CVSS vector indicates that while no user interaction is required and privileges are low, the potential for complete system compromise through availability disruption makes this a high-priority issue for enterprise security teams. Organizations should also consider implementing application-level monitoring and alerting systems to detect potential exploitation attempts before they result in service disruption, aligning with ATT&CK tactic T1498 related to denial of service attacks. The vulnerability highlights the need for comprehensive security testing of distributed systems and continuous monitoring of network traffic for indicators of compromise that could signal exploitation attempts against similar infrastructure components.