What is the CVSS score of CVE-2026-60243?

CVE-2026-60243 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Oracle Coherence CVE-2026-60243

EUVD-2026-46658 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-h23m-cr2g-v3rm

Denial Of Service Oracle Oracle Coherence Oracle Corporation

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network TCP access with low privileges required; impact is exclusively availability (crash or hang), with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:12 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial of service in Oracle Coherence's Core component allows a low-privileged network attacker to crash or indefinitely hang affected instances across four active release branches via crafted TCP communication. The attack requires no user interaction and only low privileges, making it a realistic and automatable threat for any enterprise environment where Coherence cluster ports are reachable by authenticated or low-privileged users. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Oracle's own assessment rates this as network-accessible with low complexity.

Technical ContextAI

Oracle Coherence is an enterprise-grade distributed in-memory data grid and caching platform, part of the Oracle Fusion Middleware stack, commonly deployed alongside Oracle WebLogic Server for high-availability Java applications. The vulnerability resides in the Core component, which governs fundamental clustering, data partitioning, and inter-node communication over TCP. The confirmed CPE is cpe:2.3:a:oracle_corporation:oracle_coherence, spanning four distinct release branches. No CWE identifier has been assigned, so the precise root cause class - whether resource exhaustion, an unhandled protocol exception, an infinite loop, or improper input validation - is not confirmed from available data. The TCP network vector indicates the flaw is reachable through normal cluster communication channels rather than requiring local or physical access.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses CVE-2026-60243 across all four affected release branches. The specific patched build numbers for each branch (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0) are not independently confirmed from the provided data and must be obtained directly from Oracle's CPU documentation and My Oracle Support. Until patching is complete, restrict TCP access to Oracle Coherence cluster ports (typically 7574, 9000, or custom configured ports) to only trusted internal network segments using firewall rules or host-based ACLs, reducing the pool of potential low-privileged attackers who can reach the Core component. Note that network segmentation does not eliminate risk for threat actors already operating within the allowed segment, such as compromised internal accounts.