What is the CVSS score of CVE-2026-60303?

CVE-2026-60303 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

Oracle Coherence CVE-2026-60303

EUVD-2026-46718 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-2pv8-3qcq-qggx

Denial Of Service Oracle Oracle Coherence Oracle Corporation

4.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

Network-reachable HTTP endpoint requires low-privilege credentials (PR:L); only partial availability is impacted (A:L) with no confidentiality or integrity effects.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:06 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Coherence. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Partial denial of service in Oracle Coherence's Core component allows a low-privileged, network-connected attacker to degrade availability across four supported release lines (12.2.1.4.0 through 15.1.1.0.0) via HTTP with low attack complexity. The CVSS 3.1 vector confirms a straightforward network path requiring only a valid low-privilege account and no user interaction, with impact strictly bounded to partial availability loss - confidentiality and integrity are unaffected. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog.

Technical ContextAI

Oracle Coherence is an in-memory data grid and distributed caching platform within the Oracle Fusion Middleware stack, commonly deployed in enterprise Java application tiers for high-throughput, low-latency data access and session clustering. The vulnerability resides in the Core component and is reachable over HTTP, per the AV:N vector. No CWE classification has been assigned, leaving the precise root cause class unconfirmed; however, the denial-of-service outcome combined with the network-accessible, low-complexity attack pattern is consistent with resource exhaustion, improper input handling, or a processing defect in request parsing within the Core subsystem. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_coherence spanning all four current supported releases: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

RemediationAI

Apply the patches distributed in Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. The CPU process bundles fixes for all four affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0); exact patched build identifiers should be confirmed via the Oracle support portal as no specific fixed version number was independently confirmed in the available intelligence. As a compensating control prior to patching, restrict HTTP access to Oracle Coherence Core endpoints to only authorized, authenticated network segments using firewall ACLs or API gateway policy - this limits which low-privilege accounts can reach the vulnerable component, but note that overly aggressive port blocking may disrupt legitimate Coherence cluster communication and should be validated in a non-production environment first. Monitor Coherence cluster logs and HTTP access logs for anomalous request volumes or repeated error patterns that could indicate exploitation attempts.