What is the CVSS score of CVE-2026-60252?

CVE-2026-60252 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60252?

Oracle Coherence in Oracle Fusion Middleware contains a remote denial-of-service vulnerability (CVE-2026-60252) that allows unauthenticated attackers to crash or hang the service, causing complete…

How to fix or mitigate CVE-2026-60252?

Within 24 hours, identify all instances of Oracle Fusion Middleware running vulnerable Coherence versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) and assess their network exposure; immediately implement firewall rules to restrict TCP access to Coherence services to only authorized internal application servers and clients. Within 7 days, deploy enhanced monitoring and alerting to detect abnormal connection patterns, repeated service crashes, or anomalous client activity; document the complete inventory of systems and applications dependent on each vulnerable instance, and establish baseline traffic patterns for anomaly detection. Within 30 days, establish a formal channel with Oracle Support to track patch release timelines, evaluate the feasibility and business impact of upgrading to patched versions once available, and implement network-based intrusion detection rules to alert on exploitation attempts.

Oracle Coherence CVE-2026-60252

EUVD-2026-46667 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-vwhw-84p4-v2vx

Denial Of Service Oracle Oracle Coherence Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network TCP reach with low complexity and no interaction (PR:N/UI:N/AC:L); impact is availability-only DoS, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:42 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial of service in Oracle Coherence (Core component) of Oracle Fusion Middleware allows a remote, unauthenticated attacker with TCP network access to trigger a hang or repeatable crash, producing a complete availability outage of the affected Coherence instance. It affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, carries a CVSS 3.1 base score of 7.5 (availability-only), and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid used within Oracle Fusion Middleware to provide clustered caching, data partitioning and scalable state management for Java/enterprise applications, typically communicating over TCP-based cluster and proxy/extend ports. The flaw resides in the Core component and is reachable over the network without authentication. Oracle did not assign a CWE (CWE: N/A), but the availability-only impact and 'hang or frequently repeatable crash' behavior are consistent with an unhandled input, resource-exhaustion, or infinite-loop condition (CWE-400/CWE-248/CWE-835 class) in cluster or client request processing rather than a memory-corruption/RCE bug. The affected surface is identified only broadly by CPE cpe:2.3:a:oracle_corporation:oracle_coherence:*:*:*:*:*:*:*:*.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory; see https://www.oracle.com/security-alerts/cpujul2026.html) - Oracle does not publish a standalone semantic fix version for Coherence, so apply the corresponding CPU patch/bundle for your installed release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0). Until patched, reduce exposure by restricting network reachability of Coherence cluster and proxy/extend TCP listener ports to trusted hosts only via firewall or security-group rules, and place Coherence behind a segmented internal network rather than any internet-facing interface; the trade-off is that overly tight filtering can break legitimate cluster members or Coherence*Extend clients, so scope allow-lists to known node IPs. Where feasible, enable authentication/TLS on Extend proxies and monitor for repeated connection-triggered crashes as a detection control.