What is the CVSS score of CVE-2026-60233?

CVE-2026-60233 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

Oracle Coherence CVE-2026-60233

EUVD-2026-46648 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-3389-c792-g5rw

Denial Of Service Oracle Oracle Coherence Oracle Corporation

4.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

Network-reachable via TCP, low privileges required per description, partial availability impact only, no confidentiality or integrity impact confirmed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:13 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Coherence. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Partial denial-of-service in Oracle Coherence 15.1.1.0.0 (Core component) allows a low-privileged attacker with TCP network access to intermittently degrade availability of the in-memory data grid. The CVSS 3.1 score of 4.3 reflects constrained impact - confidentiality and integrity are unaffected, and no complete service outage is possible. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis; Oracle addressed this vulnerability in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Coherence is a distributed, in-memory data grid and caching solution within the Oracle Fusion Middleware stack, widely used in enterprise Java applications for high-availability session management and data sharing across cluster nodes. Communication between cluster members occurs over TCP, which is the attack vector described here. The affected product is identified by CPE cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:* at version 15.1.1.0.0. No CWE classification was assigned by Oracle or NVD, so the precise root cause class - whether resource exhaustion, improper input validation, or another mechanism - cannot be confirmed from available data. The unchanged scope (S:U) in the CVSS vector confirms the impact is contained within the Coherence process itself and does not cascade to other system components.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, which addresses CVE-2026-60233 in Oracle Coherence 15.1.1.0.0; the advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. The specific patched build version within the July 2026 CPU is not independently confirmed from available data - consult the Oracle advisory directly for exact version numbers and patch prerequisites. As a compensating control prior to patching, restrict TCP network access to Oracle Coherence cluster communication ports (default: 7574 and Extend proxy ports) to trusted hosts and authenticated network segments using firewall rules or network access control lists; note this restriction may affect legitimate cluster members and should be implemented with care in production environments.