What is the CVSS score of CVE-2026-60223?

CVE-2026-60223 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60223?

Oracle Coherence, critical distributed data infrastructure used across the enterprise, faces a denial-of-service vulnerability affecting supported versions 12.2.1.4.0 through 15.1.1.0.0 that enables…

How to fix or mitigate CVE-2026-60223?

Within 24 hours: identify all systems running affected Coherence versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) and immediately restrict TCP network access to Coherence cluster nodes to trusted systems only using firewall rules. Within 7 days: complete network segmentation implementation to isolate Coherence services, configure host-based firewall policies, deploy network monitoring for anomalous connections to cluster nodes, and execute full testing of failover and recovery procedures. Within 30 days: monitor Oracle advisories for patch availability, develop a staged deployment plan beginning with non-production testing, and prioritize patching of business-critical Coherence instances upon vendor release.

Oracle Coherence CVE-2026-60223

EUVD-2026-46629 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-x5pq-8qrf-ww5m

Authentication Bypass Oracle Oracle Coherence Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated, low-complexity network access to a TCP listener (AV:N/AC:L/PR:N/UI:N) causing service-only crash with no data impact, so C:N/I:N/A:H, S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:52 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle Coherence (Core component of Oracle Fusion Middleware) lets an unauthenticated attacker with TCP network access hang or repeatably crash the data-grid service, producing a complete availability outage. It affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 and is rated CVSS 3.1 7.5 (availability-only). Oracle labels it easily exploitable, but there is no public exploit identified at time of analysis and it is not on CISA KEV.

Technical ContextAI

Oracle Coherence is an in-memory distributed data grid used to cache and share application state across clustered Java middleware (often behind WebLogic and Fusion Middleware stacks), exposing cluster and proxy services over TCP. The flaw sits in the product's Core component, which handles cluster membership, serialization and network message processing. Oracle does not map a CWE (listed N/A), but the availability-only, no-integrity/no-confidentiality profile is consistent with a crash-inducing input-handling defect (e.g., malformed packet or request that triggers an unhandled condition or resource exhaustion in the network listener), placing it in the CWE-400/CWE-248-style denial-of-service class rather than a memory-corruption/RCE class.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update as the primary remediation - Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html; the input does not include an exact fixed build number, so consult that CPU matrix for the patch corresponding to your version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0). Until patched, reduce exposure by restricting network reachability of Coherence cluster and proxy/extend TCP listener ports to trusted management and application subnets via firewall/security-group rules and network segmentation, which blunts unauthenticated remote access with minimal functional trade-off for properly-tiered deployments; if any Coherence port is internet-exposed, block it at the perimeter immediately. Ensure clustered redundancy and monitoring/auto-restart of Coherence nodes so a triggered hang or crash degrades gracefully rather than causing total outage, accepting that this mitigates impact but does not prevent the DoS.