CVE-2026-60255 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence as well as unauthorized update, insert or delete access to some of Oracle Coherence accessible data. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
Oracle Coherence represents a distributed caching and processing platform within Oracle Fusion Middleware that facilitates high-performance data management across distributed systems. This vulnerability exists within the core component of Oracle Coherence and affects multiple versions including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, making it a widespread concern for organizations utilizing these middleware implementations.
The technical flaw manifests as an insufficient input validation mechanism within the network protocol handling of Oracle Coherence's TCP communication layer. An unauthenticated attacker can exploit this weakness by sending specially crafted malicious packets to the target system's listening TCP ports without requiring any authentication credentials or prior access privileges. This vulnerability falls under CWE-20, which describes improper input validation, and represents a critical weakness in the software's security architecture that allows arbitrary network-based attacks.
The operational impact of this vulnerability is severe and multifaceted, as it provides attackers with complete control over the availability and integrity aspects of the affected Oracle Coherence instances. Successful exploitation can result in denial-of-service conditions where the system becomes unresponsive or crashes repeatedly, effectively rendering the distributed caching service unavailable to legitimate users. Additionally, attackers can perform unauthorized data manipulation operations including updates, inserts, and deletes against the cached data stores, potentially leading to data corruption and integrity violations.
The CVSS 3.1 score of 8.2 reflects the high severity nature of this vulnerability with a base score indicating high impact across both availability and integrity dimensions. The attack vector is classified as network-based (AV:N) requiring no user interaction or privileges, while the low access complexity (AC:L) makes exploitation straightforward. This vulnerability directly maps to several ATT&CK techniques including T1499 for network denial of service attacks and T1566 for initial access through network services.
Organizations should immediately implement network segmentation controls to restrict access to Oracle Coherence TCP ports from trusted networks only, while also deploying firewall rules to limit exposure to external threats. The most effective mitigation involves applying the latest patches and updates provided by Oracle to address this specific vulnerability. Additionally, monitoring network traffic for suspicious patterns and implementing intrusion detection systems can help identify potential exploitation attempts before they succeed. System administrators should also consider disabling unnecessary TCP services and regularly reviewing access controls to minimize the attack surface available to potential adversaries.