CVE-2026-60235

Received Received - Intake

Denial of Service in Oracle Coherence

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Oracle

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence as well as unauthorized update, insert or delete access to some of Oracle Coherence accessible data and unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-60235

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	coherence	15.1.1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Coherence 15.1.1.0.0 where an unauthenticated attacker can remotely exploit it via TCP network access. It allows causing repeated crashes or hangs in the service, leading to a denial of service (DOS). Additionally, it may permit unauthorized data access or modifications to some data within Oracle Coherence.

Impact Analysis

If you use Oracle Coherence 15.1.1.0.0, an attacker could disrupt your service by causing crashes or hangs, leading to downtime. They might also access or alter some of your data without permission, affecting confidentiality and integrity.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, which may violate GDPR (data protection) and HIPAA (health data privacy) requirements. Compliance could be impacted if sensitive data is exposed or altered due to the vulnerability.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Coherence version 15.1.1.0.0. Restrict network access to TCP ports used by Oracle Coherence. Monitor system logs for unusual activity or crashes.

Hi! I’m here to help you understand CVE-2026-60235. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70