CVE-2026-60233 Overview
CVE-2026-60233 is a denial of service vulnerability in the Oracle Coherence product of Oracle Fusion Middleware. The affected component is Core, and the supported affected version is 15.1.1.0.0. A low-privileged attacker with network access via TCP can exploit this flaw to cause a partial denial of service against Oracle Coherence. The weakness is categorized as uncontrolled resource consumption [CWE-400]. Oracle addressed the issue in the July 2026 Critical Patch Update.
Critical Impact
Successful exploitation results in a partial denial of service of Oracle Coherence, degrading availability of dependent Fusion Middleware workloads.
Affected Products
- Oracle Fusion Middleware
- Oracle Coherence
- Oracle Coherence version 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60233 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60233
Vulnerability Analysis
The vulnerability resides in the Core component of Oracle Coherence, the in-memory data grid used across Oracle Fusion Middleware deployments. An authenticated attacker holding low-level privileges can send crafted requests over TCP to trigger uncontrolled resource consumption. The attack does not require user interaction and executes at low complexity. Impact is limited to availability, with no confidentiality or integrity effect. Because Coherence often backs clustered services and caching tiers, a partial denial of service can propagate latency and errors to dependent applications.
Root Cause
The issue maps to [CWE-400] uncontrolled resource consumption. The Core component fails to sufficiently constrain resources allocated when processing certain network-delivered inputs. Repeated or malformed requests can exhaust CPU, memory, or thread resources, degrading service responsiveness.
Attack Vector
The attack vector is network-based over TCP. The attacker must possess a valid low-privileged account on the target Coherence instance. No user interaction is required, and the scope is unchanged. Public exploit code is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.344% with a percentile of 26.826.
No verified proof-of-concept code is available. See the Oracle Security Alert July 2026 for vendor-supplied technical details.
Detection Methods for CVE-2026-60233
Indicators of Compromise
- Sudden spikes in CPU, heap, or thread utilization on Oracle Coherence cluster nodes without a corresponding workload increase.
- Repeated TCP connections or requests from a single authenticated principal to Coherence cluster ports.
- Coherence log entries indicating request timeouts, dropped members, or resource exhaustion during a targeted window.
Detection Strategies
- Baseline normal Coherence request rates per authenticated user and alert on statistical deviations.
- Correlate authentication events with resource utilization metrics to identify low-privileged accounts driving abnormal load.
- Monitor Java Virtual Machine (JVM) telemetry from Coherence nodes for garbage collection pressure and thread pool saturation.
Monitoring Recommendations
- Forward Coherence and Fusion Middleware logs to a centralized analytics platform for cross-node correlation.
- Track TCP session counts and payload sizes to Coherence cluster ports and flag sustained anomalies.
- Enable alerting on Coherence health check failures and partition rebalancing events triggered by node unresponsiveness.
How to Mitigate CVE-2026-60233
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle Coherence 15.1.1.0.0 deployments.
- Inventory all Fusion Middleware environments embedding Coherence to confirm patch coverage.
- Review and reduce the number of accounts with network access to Coherence cluster endpoints.
Patch Information
Oracle released a fix in the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Security Alert July 2026 and apply the patch aligned to Oracle Coherence 15.1.1.0.0.
Workarounds
- Restrict TCP access to Coherence cluster ports using network segmentation and firewall access control lists.
- Enforce least privilege on Coherence accounts and remove unused low-privileged credentials.
- Configure request throttling and resource quotas at the application tier to limit exhaustion impact until patching is complete.
# Configuration example
# Restrict inbound TCP to Coherence cluster ports to trusted subnets only
iptables -A INPUT -p tcp --dport 7574 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
