What is the CVSS score of CVE-2026-60301?

CVE-2026-60301 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Coherence are affected by CVE-2026-60301?

Oracle Coherence (Fusion Middleware component) contains an unauthenticated denial-of-service vulnerability that enables network attackers to crash or hang the in-memory data grid, resulting in…

How to fix or mitigate CVE-2026-60301?

Within 24 hours: Complete asset inventory of all systems running affected Coherence versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) and immediately restrict TCP network access to Coherence ports via firewall rules or network ACLs, limiting connectivity to trusted internal sources only. Within 7 days: Implement network segmentation to isolate Coherence cluster infrastructure from untrusted networks, deploy monitoring and alerting for abnormal connection patterns and repeated service crashes, and document current system dependencies to prioritize upgrade sequencing. Within 30 days: Establish a continuous watch on Oracle security advisories for patch availability, develop and test an upgrade plan to patched Coherence versions within your change management process, and identify expedited upgrade windows for systems in critical business paths.

Oracle Coherence CVE-2026-60301

EUVD-2026-46716 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-jf42-85gf-mpr9

Denial Of Service Oracle Oracle Coherence Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated (PR:N), low-complexity TCP-reachable request (AV:N/AC:L) causing a repeatable crash with only availability impact (A:H; C:N/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:22 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle Coherence (Core component) of Oracle Fusion Middleware lets an unauthenticated attacker with TCP network access hang or repeatedly crash the in-memory data grid, producing a complete availability outage. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; the CVSS 3.1 base score is 7.5 with a pure availability impact (A:H). Oracle rates it 'easily exploitable,' but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Coherence is a distributed in-memory data grid and caching platform bundled with Oracle Fusion Middleware, used to cluster application state and share data across JVM nodes over TCP (Coherence*Extend / cluster protocols). The flaw resides in the Core component and is reachable directly over the network via TCP without authentication, consistent with a malformed-request or resource-exhaustion condition in cluster/proxy message handling. Oracle did not assign a CWE (CWE: N/A), but the symptom profile - a hang or frequently repeatable crash triggered remotely with no data exposure (C:N/I:N) - maps to the uncaught-exception / uncontrolled-resource-consumption class (e.g., CWE-400 or CWE-248) rather than a memory-corruption or logic-bypass bug. The single CPE, cpe:2.3:a:oracle_corporation:oracle_coherence, confirms the product scope is Coherence itself rather than a downstream WebLogic or Fusion application.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for each affected branch - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; Oracle distributes these as CPU patches rather than named point releases, so the exact patched build should be taken from the CPU patch matrix for your version (Patch available per vendor advisory). Until patching, restrict network exposure of Coherence cluster and Coherence*Extend proxy TCP ports to trusted hosts only via firewall/security-group ACLs, and place proxy tiers behind network segmentation so untrusted clients cannot reach the listener - the trade-off is that legitimate remote Extend clients must be explicitly allowlisted. Where feasible, enable TCP client authentication/TLS on Coherence*Extend proxies to force authentication before message processing, accepting the configuration and certificate-management overhead. Because impact is a hang/crash, also ensure cluster nodes are supervised (auto-restart) to limit outage duration, though this does not prevent repeated attacks.