CVE-2026-60252 Overview
CVE-2026-60252 is a denial-of-service vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, affecting the Core component. The flaw allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence availability. Successful exploitation causes a hang or a frequently repeatable crash, resulting in complete denial of service. The vulnerability is classified under [CWE-400] (Uncontrolled Resource Consumption). Affected versions include Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Critical Impact
Unauthenticated network attackers can trigger a complete denial of service against Oracle Coherence clusters supporting data grids and caching layers in enterprise Fusion Middleware deployments.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE CVE-2026-60252 published to NVD
- 2026-07-23 - Last updated in NVD database
- July 2026 - Addressed in the Oracle Critical Patch Update Advisory - July 2026
Technical Details for CVE-2026-60252
Vulnerability Analysis
The vulnerability resides in the Core component of Oracle Coherence, an in-memory data grid used across Oracle Fusion Middleware for distributed caching and session management. An unauthenticated attacker sends crafted traffic over TCP to a listening Coherence port. The Coherence process either hangs or crashes on a repeatable basis, producing sustained downtime for dependent applications.
Because Coherence often underpins clustered application state and session replication, a single denial-of-service event can cascade to Java application servers and downstream services relying on the grid. The issue impacts availability only; confidentiality and integrity are not affected.
Root Cause
The flaw is classified under [CWE-400] Uncontrolled Resource Consumption. A specific request pattern on the Coherence TCP listener causes the service to consume resources or reach an invalid state that terminates the process. Oracle has not publicly disclosed the exact code path involved.
Attack Vector
Exploitation requires only network reachability to a Coherence TCP port. No authentication, user interaction, or elevated privileges are required. Attackers with access to management or cluster networks where Coherence nodes are exposed can trigger the condition remotely. The current EPSS probability is 0.441%, indicating limited observed exploitation attempts.
No verified public proof-of-concept code is available. Consult the Oracle Security Alert July 2026 for vendor technical details.
Detection Methods for CVE-2026-60252
Indicators of Compromise
- Repeated Coherence node crashes, restarts, or unresponsive states without correlated workload changes.
- Java stack traces or heap dumps generated at the Coherence TCP listener during unexpected client sessions.
- Spikes in inbound TCP connections to Coherence cluster ports from unexpected sources.
Detection Strategies
- Monitor Coherence process lifecycle events and correlate crashes with inbound TCP traffic bursts to cluster ports.
- Alert on Coherence cluster membership changes, node evictions, or repeated failover events triggered without operational cause.
- Inspect network flow logs for connections to Coherence ports from clients outside the approved application tier.
Monitoring Recommendations
- Ingest Coherence JVM logs, thread dumps, and crash artifacts into a centralized logging platform for correlation.
- Track availability metrics on services that depend on Coherence, including request latency and cache hit ratios.
- Baseline expected client IP ranges for Coherence ports and alert on deviations.
How to Mitigate CVE-2026-60252
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update for Fusion Middleware to every affected Coherence version.
- Inventory all Coherence deployments across environments and confirm version levels against 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
- Restrict network reachability to Coherence TCP ports so only authorized application tier hosts can connect.
Patch Information
Oracle addressed CVE-2026-60252 in the July 2026 Critical Patch Update. Refer to the Oracle Security Alert July 2026 for patch identifiers and installation instructions specific to each Coherence release train.
Workarounds
- Enforce firewall rules and network segmentation to limit Coherence cluster traffic to trusted subnets.
- Enable Coherence Well Known Addresses (WKA) and TLS-secured cluster communication to restrict rogue client connectivity.
- Deploy load balancer or proxy rate limiting in front of exposed Coherence endpoints where direct access cannot be eliminated.
# Example: restrict Coherence cluster port with iptables
iptables -A INPUT -p tcp --dport 7574 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
