Description
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-07-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A TCP‑based vulnerability in Oracle Coherence’s Core component can be triggered by an attacker with low privileges and network access, enabling the craft of specific traffic that causes the service to hang or crash repeatedly. The flaw is an instance of Improper Access Control (CWE‑284) and results in a complete denial of service, with no direct compromise of data or elevation of privileges.

Affected Systems

Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 from Oracle Corporation are affected. Any deployment of these releases that is reachable over the network exposes the service to this vulnerability.

Risk and Exploitability

The CVSS 3.1 base score of 6.5 indicates a moderate severity with a significant availability impact. The EPSS score of less than 1% suggests a low likelihood of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. The attack can be carried out over an unauthenticated TCP connection and does not require elevated privileges, making the attack vector relatively easy for an attacker with network access.

Generated by OpenCVE AI on August 4, 2026 at 04:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle security patch released in the CPU Jul 2026 advisory for the affected Coherence versions
  • Restrict inbound TCP traffic to Coherence ports to trusted hosts or networks using firewall rules or ACLs
  • Enable or increase resource‑limiting and timeout settings for the Coherence service, if configurable, to reduce the impact of repeated crashes
  • Monitor Coherence logs and network traffic for abnormal activity such as frequent hangs or large packets, and respond promptly to detected anomalies
  • Ensure proper access control is enforced within the Coherence service to address the CWE‑284 flaw, following best practices for authorization

Generated by OpenCVE AI on August 4, 2026 at 04:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 23:00:00 +0000

Type Values Removed Values Added
Title TCP‑based Denial of Service in Oracle Coherence
Weaknesses CWE-400

Fri, 24 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
Title TCP‑based Denial of Service in Oracle Coherence
Weaknesses CWE-400

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle coherence
CPEs cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:14.1.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:15.1.1.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle coherence
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Coherence
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T18:47:33.771Z

Reserved: 2026-07-08T15:51:40.529Z

Link: CVE-2026-60304

cve-icon Vulnrichment

Updated: 2026-07-23T18:47:24.747Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T04:30:04Z

Weaknesses