CVE-2026-60303 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Coherence. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
Oracle Coherence represents a distributed caching and processing platform within Oracle Fusion Middleware that facilitates high-performance data management across distributed systems. This vulnerability exists within the core component of the software and affects multiple versions including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, indicating a widespread impact across the product lifecycle. The vulnerability manifests as a security flaw that allows attackers with low privileges and network access through HTTP protocols to compromise the integrity of the Coherence system.
The technical nature of this vulnerability stems from insufficient input validation or authentication mechanisms within the HTTP handling components of Oracle Coherence. Attackers can exploit this weakness by crafting specific HTTP requests that bypass normal access controls, potentially allowing them to manipulate the distributed caching infrastructure. The CVSS 3.1 scoring system assigns a base score of 4.3 with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, indicating that this vulnerability is easily exploitable with low attack complexity and requires only low privileges for successful exploitation. The availability impact rating of L suggests that while the primary effect is partial denial of service rather than complete system compromise, the disruption can significantly impair operational functionality.
The operational impact of this vulnerability extends beyond simple service interruption as it affects the core distributed computing capabilities that organizations rely upon for maintaining data consistency and application performance. When compromised, Oracle Coherence instances may experience partial denial of service conditions that can cascade through dependent applications and services, potentially affecting business-critical operations that depend on distributed caching mechanisms. The vulnerability's accessibility via HTTP protocols makes it particularly concerning as it can be exploited from external network positions without requiring physical access or elevated privileges.
Organizations utilizing affected Oracle Coherence versions should prioritize immediate remediation through official patches provided by Oracle to address the underlying security flaw. Network segmentation and access control measures can provide temporary mitigation while permanent solutions are implemented, though these do not eliminate the vulnerability itself. The ATT&CK framework categorizes this type of vulnerability under privilege escalation and denial of service tactics, with the low privilege requirement and network accessibility aligning with techniques commonly used in initial access phases. Compliance with security standards such as those outlined in CWE (Common Weakness Enumeration) related to input validation and authentication controls becomes critical for organizations seeking to maintain secure distributed computing environments.
Security monitoring should focus on identifying anomalous HTTP traffic patterns that may indicate exploitation attempts against the Coherence service. Log analysis of HTTP request handling within affected systems can help detect potential abuse of this vulnerability before it results in operational disruption. System administrators should implement network-level controls that limit access to Coherence services to trusted networks and IP addresses, reducing the attack surface available to potential adversaries. The vulnerability's classification as easily exploitable underscores the importance of maintaining current security patches and implementing comprehensive vulnerability management programs that address both known and emerging threats in distributed computing platforms.