CVE-2026-60243: Oracle Coherence DOS Vulnerability

CVE-2026-60243 Overview

CVE-2026-60243 is a denial of service vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low-privileged attacker with network access over TCP can exploit the issue without user interaction. Successful exploitation causes a hang or repeatable crash, resulting in a complete denial of service of Oracle Coherence. The weakness is categorized under CWE-400: Uncontrolled Resource Consumption. Oracle addressed the vulnerability in the July 2026 Critical Patch Update.

Critical Impact
An authenticated network attacker can trigger a complete denial of service of Oracle Coherence, disrupting caching, data grid operations, and any downstream applications that depend on the cluster.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0
Oracle Coherence 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60243 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60243

Vulnerability Analysis

Oracle Coherence is a distributed in-memory data grid used to scale application state across clustered JVMs. This vulnerability resides in the Core component, which handles cluster membership, request dispatch, and cache operations over TCP. An attacker holding a low-privileged account can send crafted network traffic that exhausts internal resources or triggers a fault path in the Core processing logic. The result is either a hang of the Coherence service or a repeatable crash that constitutes a complete denial of service.

Coherence commonly underpins caching layers, session replication, and transactional data grids for Java EE and WebLogic deployments. A hang or crash of the cluster propagates to every application relying on the grid, producing cascading service outages. Because the attack vector is network-based and complexity is low, exploitation is straightforward once an attacker obtains any authenticated foothold.

Root Cause

The issue maps to CWE-400: Uncontrolled Resource Consumption. The Core component fails to bound resource usage or validate input during specific TCP-borne operations, allowing an attacker to drive the process into an unrecoverable state. Oracle has not disclosed the precise code path in the public advisory.

Attack Vector

Exploitation requires TCP connectivity to a Coherence cluster port and a low-privileged authenticated identity. No user interaction is required. Confidentiality and integrity are not impacted, but availability is fully compromised. Detailed exploitation mechanics are documented in the Oracle Security Alert July 2026 advisory.

Detection Methods for CVE-2026-60243

Indicators of Compromise

Unexpected termination or hang of Coherence JVM processes without corresponding administrative action.
Cluster membership churn, repeated node departures, or PANIC and OutOfMemoryError entries in Coherence logs.
Spikes in inbound TCP connections to Coherence Unicast or Extend proxy ports from unusual sources.

Detection Strategies

Monitor Coherence JMX metrics for abrupt drops in cluster size, elevated GC activity, or thread pool saturation.
Correlate Coherence service restarts with preceding network traffic patterns to identify triggering sources.
Alert on repeated crash-restart cycles of WebLogic or standalone Coherence nodes within short intervals.

Monitoring Recommendations

Forward Coherence, WebLogic, and JVM crash logs to a centralized SIEM for correlation with network telemetry.
Baseline normal Coherence cluster port traffic and alert on deviations from application tiers or external subnets.
Track authentication events for Coherence and Extend clients to detect low-privileged accounts issuing anomalous request volumes.

How to Mitigate CVE-2026-60243

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes for Oracle Coherence to all affected versions.
Inventory Coherence deployments across environments, including embedded WebLogic instances, and prioritize internet-adjacent clusters.
Restrict Coherence cluster and Extend proxy ports to trusted application subnets using network ACLs or host firewalls.

Patch Information

Oracle released fixes as part of the Critical Patch Update Advisory. Refer to the Oracle Security Alert July 2026 for patch identifiers and installation instructions covering versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Workarounds

Segment Coherence traffic onto isolated VLANs and block untrusted sources from reaching cluster ports.
Enforce least privilege on Coherence and Extend client accounts to minimize the pool of identities capable of triggering the flaw.
Enable Coherence SSL and identity token authentication to raise the bar for network-based abuse until patches are deployed.

bash

# Example iptables restriction limiting Coherence cluster ports to a trusted subnet
iptables -A INPUT -p tcp --dport 7574 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
iptables -A INPUT -p tcp --dport 9099 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP