CVE-2026-60223 Overview
CVE-2026-60223 is a denial-of-service vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, specifically in the Core component. An unauthenticated attacker with network access via TCP can compromise the availability of Oracle Coherence. Successful exploitation results in a hang or a frequently repeatable crash, producing a complete denial of service. The vulnerability is classified under [CWE-284] (Improper Access Control) and affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle addressed the issue in the July 2026 Critical Patch Update.
Critical Impact
Remote, unauthenticated attackers can trigger a complete denial of service against Oracle Coherence clusters, disrupting distributed caching, session replication, and dependent Fusion Middleware workloads.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60223 published to NVD as part of the Oracle July 2026 Critical Patch Update
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60223
Vulnerability Analysis
Oracle Coherence is a distributed, in-memory data grid used across Oracle Fusion Middleware for caching, session replication, and stateful clustering. CVE-2026-60223 exposes the Coherence Core component to remote attackers over TCP with no authentication or user interaction required. Exploitation does not disclose or modify data. Instead, it forces Coherence into a hang state or triggers a repeatable crash, taking down the affected node or cluster.
The advisory maps this issue to improper access control [CWE-284]. In practice, a Coherence process accepts and processes attacker-controlled network input on a cluster or extend-client port without adequately validating the sender or the message contents, allowing an unauthenticated peer to drive the service into an unrecoverable state.
The EPSS probability is 0.441% as of 2026-07-23, and no public proof-of-concept or exploitation in the wild is currently listed.
Root Cause
The root cause is insufficient access control on network-reachable Coherence endpoints. The Core component processes inbound TCP messages from peers or clients before enforcing sufficient authentication or protocol validation. A malformed or unexpected message from an untrusted source is sufficient to induce the crash or hang condition.
Attack Vector
The attacker requires only network reachability to a Coherence TCP listener, typically the cluster port or a Coherence*Extend proxy port. No credentials, privileges, or user interaction are needed. The impact is limited to availability, with confidentiality and integrity unaffected. Repeated exploitation can be used to keep Coherence offline and starve dependent Fusion Middleware services.
No verified exploit code is publicly available. Refer to the Oracle Critical Patch Update Advisory - July 2026 for the authoritative technical details.
Detection Methods for CVE-2026-60223
Indicators of Compromise
- Unexpected termination, hang, or restart of Coherence JVM processes correlated with inbound TCP connections from unknown hosts.
- Repeated OutOfMemoryError, IOException, or protocol decoding stack traces in Coherence logs originating from unauthenticated peers.
- Spikes of short-lived TCP sessions to Coherence cluster or Coherence*Extend proxy ports from IP addresses outside the cluster subnet.
Detection Strategies
- Alert on Coherence node restarts and cluster membership changes that occur without a corresponding change or deployment event.
- Monitor for inbound connections to Coherence ports from sources outside the approved cluster and application tier allowlist.
- Correlate JVM crash dumps and heap dumps with network flow data to identify the triggering client address.
Monitoring Recommendations
- Ingest WebLogic and Coherence server logs, JVM garbage collection logs, and host process telemetry into a central analytics platform for continuous review.
- Track availability of Coherence services through synthetic cache reads and writes, and page on repeated failures.
- Enable NetFlow or packet capture on segments hosting Coherence to retain forensic evidence of DoS attempts.
How to Mitigate CVE-2026-60223
Immediate Actions Required
- Apply the Oracle July 2026 Critical Patch Update to all Coherence installations running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
- Restrict TCP access to Coherence cluster ports and Coherence*Extend proxy ports to known application and cluster nodes only.
- Inventory Fusion Middleware deployments that embed Coherence, including WebLogic Server, and prioritize patching internet-adjacent instances.
Patch Information
Oracle released fixes as part of the July 2026 Critical Patch Update. Consult the Oracle Security Alert July 2026 for the exact patch identifiers, download locations, and installation instructions for each affected Coherence version.
Workarounds
- Place Coherence cluster traffic on an isolated VLAN or private subnet unreachable from user or internet networks.
- Enforce host-based firewall rules or Kubernetes NetworkPolicies limiting inbound TCP to Coherence ports to explicit peer addresses.
- Enable Coherence SSL and identity token authentication for Extend clients to reject unauthenticated peers where operationally feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
