CVE-2026-60252
Summary
by MITRE • 07/21/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability resides within Oracle Coherence, a distributed caching and processing platform that forms part of Oracle Fusion Middleware. The affected versions span across multiple release lines including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, indicating a widespread issue affecting the core functionality of this middleware component. The vulnerability is classified as easily exploitable, meaning that attackers require minimal technical expertise to leverage it successfully. The attack vector operates through TCP network connections without requiring authentication, making it particularly dangerous as it can be exploited by any remote attacker who can establish network connectivity to the affected system.
The technical flaw manifests in how Oracle Coherence processes incoming network requests, creating a condition where malformed or specially crafted TCP packets can trigger system instability. This vulnerability specifically targets the availability aspect of the system's security posture, allowing attackers to induce complete denial of service conditions through either system hangs or repeated crashes that make the service completely unavailable. The CVSS 3.1 scoring of 7.5 reflects the high impact potential with a base score indicating high availability impact and low attack complexity requirements. The vector analysis shows AV:N (network access), AC:L (low attack complexity), PR:N (no privileges required), UI:N (no user interaction needed), and S:U (unspecified scope), confirming this as a critical remote exploitation threat.
The operational impact of this vulnerability extends beyond simple service disruption, potentially affecting entire enterprise applications that depend on Oracle Coherence for distributed data management and processing. Organizations utilizing these affected versions face significant risk of business interruption and service unavailability, particularly in mission-critical environments where continuous operation is essential. The vulnerability's characteristics align with CWE-119 (Improper Restriction of Operations within a Limited Life Buffer) and CWE-476 (NULL Pointer Dereference), suggesting memory management or input validation flaws in the network processing layer. From an ATT&CK framework perspective, this vulnerability maps to T1499.004 (Endpoint Denial of Service) and potentially T1595.001 (Network Denial of Service), representing a sophisticated approach to service disruption that can be executed without requiring advanced privileges or specialized tools.
Mitigation strategies should prioritize immediate patching of affected systems, implementing network segmentation to restrict access to Oracle Coherence services, and deploying firewall rules to limit TCP port exposure. Organizations should also consider disabling unnecessary network services and implementing monitoring solutions to detect anomalous traffic patterns indicating exploitation attempts. The vulnerability's classification as unauthenticated and remotely exploitable makes it particularly critical for organizations with exposed services on public networks. Regular security assessments and vulnerability scanning should be implemented to identify and remediate similar issues across the enterprise infrastructure, while incident response procedures should be updated to address potential denial of service scenarios involving distributed caching systems.