CVE-2026-60304 in Coherence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Coherence, a distributed caching and processing platform that forms part of Oracle Fusion Middleware. The flaw exists in the Core component of this middleware solution and affects specific version ranges including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability represents a significant availability risk that can be exploited by attackers with minimal privileges and network connectivity through TCP protocols. According to CVSS 3.1 scoring, this presents a moderate to high severity threat with a base score of 6.5, specifically targeting system availability with potential for complete denial of service conditions.
The technical nature of this vulnerability allows an attacker with low privilege levels and network access via TCP to compromise the Oracle Coherence service. This represents a critical flaw in the system's security architecture as it enables unauthorized users to perform actions that can cause either temporary hangs or repeated crashes within the Coherence infrastructure. The attack vector specifically leverages TCP network connections, suggesting that the vulnerability may be exploitable through crafted network packets or protocol interactions that trigger memory corruption or resource exhaustion conditions within the Coherence processing components.
The operational impact of this vulnerability extends beyond simple service disruption to potentially causing complete system outages that can affect business-critical applications relying on Oracle Coherence for distributed caching and data processing. When successfully exploited, the vulnerability enables attackers to cause either temporary system hangs that require manual intervention or frequent crashes that can lead to continuous availability issues. This type of attack pattern aligns with availability-focused threats typically classified under CWE-400 (Uncontrolled Resource Consumption) and may also exhibit characteristics similar to CWE-129 (Improper Validation of Array Index) or CWE-131 (Incorrect Calculation of Buffer Size) depending on the underlying implementation details.
Organizations utilizing affected Oracle Coherence versions face substantial risk from this vulnerability as it can be exploited by attackers with minimal privileges, potentially allowing unauthorized users to perform denial-of-service attacks that could compromise entire distributed application architectures. The vulnerability's ease of exploitation makes it particularly dangerous in environments where network access is not properly restricted or where insufficient network segmentation exists between trusted and untrusted zones. This aligns with ATT&CK technique T1499.004 (Endpoint Denial of Service) and represents a significant concern for organizations following security frameworks like NIST SP 800-53 controls related to availability.
Mitigation strategies should focus on immediate patching of affected versions to address the underlying vulnerability while implementing network-level protections such as firewall rules restricting TCP access to Oracle Coherence services. Organizations should also consider deploying intrusion detection systems that can monitor for suspicious network activity patterns associated with this vulnerability type, particularly focusing on unusual connection attempts or protocol anomalies that might indicate exploitation attempts. The recommended approach includes applying Oracle's security patches promptly while maintaining proper network segmentation and access controls to limit the attack surface and reduce the likelihood of successful exploitation in production environments.