CVE-2026-60223

Analyzed Analyzed - Analysis Complete

Denial of Service in Oracle Coherence

Publication date: 2026-07-21

Last updated on: 2026-07-24

Assigner: Oracle

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-24

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60223

EUVD

EUVD-2026-46629

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	coherence	12.2.1.4.0
oracle	coherence	14.1.1.0.0
oracle	coherence	14.1.2.0.0
oracle	coherence	15.1.1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a denial-of-service (DoS) vulnerability in Oracle Coherence, a middleware product. It allows unauthenticated attackers to remotely crash the service by sending specially crafted network requests over TCP. The vulnerability affects versions 12.2.1.4.0 through 15.1.1.0.0.

Detection Guidance

This CVE describes a denial-of-service vulnerability in Oracle Coherence. Detection typically involves checking for vulnerable versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) and monitoring for crashes or hangs in the service. Use network scanning tools like nmap to identify Oracle Coherence instances and verify their versions. Check application logs for repeated crashes or high CPU usage in the Coherence service.

Impact Analysis

If exploited, this vulnerability can cause Oracle Coherence to hang or crash repeatedly, disrupting availability of services relying on it. This leads to downtime and potential loss of functionality for applications using affected versions.

Compliance Impact

This vulnerability causes denial-of-service (DoS) conditions in Oracle Coherence, leading to system unavailability. Such disruptions may violate compliance requirements under GDPR (availability of personal data) and HIPAA (access to protected health information), depending on system usage.

Mitigation Strategies

Apply the latest Oracle Coherence patches for affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) as soon as possible. Restrict network access to Oracle Coherence ports via firewalls to limit exposure. Monitor for unusual network traffic or service disruptions targeting Oracle Coherence.

Hi! I’m here to help you understand CVE-2026-60223. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70