CVE-2026-60255: Oracle Coherence DoS Vulnerability

CVE-2026-60255 Overview

CVE-2026-60255 is a high-severity vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker with network access via TCP to compromise Oracle Coherence. Successful exploitation can cause a complete denial of service through a hang or repeatable crash, and permits unauthorized update, insert, or delete operations against accessible data. The vulnerability is categorized under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Unauthenticated network attackers can crash Oracle Coherence clusters and tamper with cluster-accessible data, disrupting middleware services and downstream applications.

Affected Products

Oracle Coherence 12.2.1.4.0
Oracle Coherence 14.1.1.0.0 and 14.1.2.0.0
Oracle Coherence 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60255 published to NVD as part of the Oracle Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60255

Vulnerability Analysis

Oracle Coherence is an in-memory data grid used by Oracle Fusion Middleware to provide distributed caching and clustered data services across Java application tiers. Cluster members communicate over TCP to replicate state, coordinate cache operations, and manage cluster membership. This vulnerability enables an unauthenticated attacker with network reachability to Coherence TCP listeners to interact with the service in a way that triggers a hang or repeatable crash and permits limited unauthorized modification of data accessible to Coherence.

The attack requires no privileges and no user interaction, and Oracle rates the flaw as easily exploitable. Impact is concentrated on integrity and availability, with availability marked as high because a successful attack yields a complete denial of service for the affected Coherence instance. In production environments, a Coherence outage cascades into application session loss, cache stampedes, and downstream service degradation.

Root Cause

The [CWE-306] classification indicates that a critical function reachable over the network is exposed without authentication. Coherence cluster protocols historically rely on network segmentation and Well Known Address lists rather than mutual authentication of every request, which allows a reachable peer to submit operations that would otherwise require trust.

Attack Vector

Exploitation occurs over TCP from any host that can reach a Coherence cluster port. Attackers send crafted cluster or client traffic to a listening Coherence node to trigger the crash or data modification behavior. No credentials or user interaction are required. Because no verified public exploit code is available, defenders should consult the Oracle Critical Patch Update advisory for technical detail.

Detection Methods for CVE-2026-60255

Indicators of Compromise

Unexpected termination or repeated restarts of coherence JVM processes without an operator-initiated cause.
Cluster membership churn events in Coherence logs, including Member(Id=…) left or TcmpDispatcher errors originating from unknown remote addresses.
Inbound TCP connections to Coherence cluster or Extend proxy ports (commonly 7574, 9099, or custom values) from hosts outside the approved cluster network.

Detection Strategies

Alert on Coherence node crashes correlated with inbound TCP traffic from non-cluster source addresses.
Monitor cache mutation events for writes, updates, or deletes that do not originate from an authenticated application tier.
Compare Coherence Well Known Address (WKA) membership against actual observed cluster peers to identify unauthorized participants.

Monitoring Recommendations

Ingest Coherence and WebLogic logs into a centralized SIEM and build detections for repeated cluster crash and rejoin sequences.
Capture NetFlow or firewall logs for Coherence TCP ports and alert on connections from outside the defined cluster subnet.
Track EPSS movement for CVE-2026-60255 (currently 0.384%) and Oracle CPU exploit disclosures to reprioritize patching windows.

How to Mitigate CVE-2026-60255

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 deployments.
Restrict Coherence TCP ports to cluster members and authorized application tiers using host firewalls and network ACLs.
Inventory all Oracle Fusion Middleware installations that embed Coherence, including WebLogic Server, SOA Suite, and Identity Management stacks.

Patch Information

Oracle addressed CVE-2026-60255 in the Oracle Critical Patch Update - July 2026. Apply the Coherence patches for the specific base version in use. Coordinate rolling restarts to preserve cluster availability, and validate cache state after patching.

Workarounds

Isolate Coherence cluster traffic on a dedicated management VLAN unreachable from user or internet-facing networks.
Enable Coherence Secure Sockets Layer (SSL) for cluster and Extend client communication to require certificate-based peer validation.
Configure WellKnownAddresses and authorized-hosts filters in the Coherence operational configuration to restrict which peers may join the cluster.

bash

# Example: restrict Coherence cluster ports to a trusted subnet on Linux
iptables -A INPUT -p tcp --dport 7574 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
iptables -A INPUT -p tcp --dport 9099 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j DROP