CVE-2026-60301 Overview
CVE-2026-60301 is a denial-of-service vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. An unauthenticated attacker with network access over TCP can trigger a hang or repeatable crash, resulting in complete unavailability of the affected Coherence instance. The flaw affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle disclosed the issue in its July 2026 Critical Patch Update. The vulnerability impacts availability only, with no direct effect on confidentiality or integrity.
Critical Impact
Unauthenticated network attackers can crash or hang Oracle Coherence clusters, disrupting caching and data grid services that underpin dependent Fusion Middleware and application workloads.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60301 published to NVD
- 2026-07-23 - Last updated in NVD database
- July 2026 - Addressed in the Oracle Security Alert: July 2026
Technical Details for CVE-2026-60301
Vulnerability Analysis
Oracle Coherence is an in-memory data grid used for distributed caching, session replication, and low-latency data access in Fusion Middleware deployments. The vulnerability resides in the Core component and is reachable over TCP without authentication. A crafted request causes the Coherence process to hang or crash repeatedly, producing a complete denial of service.
The EPSS score is 0.441% with a percentile of 35.997, indicating no observed in-the-wild exploitation activity at disclosure. Coherence often runs as a shared clustered service, so a successful attack can cascade into outages for every application depending on that grid for cache lookups or state.
Root Cause
Oracle has not published detailed root-cause information beyond the advisory. The behavior — a repeatable crash triggered by a network request with no privileges required — is consistent with an unhandled exception or resource exhaustion condition in the Coherence Core request-processing path. Refer to the Oracle Security Alert: July 2026 for vendor-supplied technical context.
Attack Vector
Exploitation requires only TCP network reachability to a Coherence cluster member port. No user interaction and no credentials are needed. An attacker on the same network segment, or any environment where Coherence cluster ports are exposed beyond trusted hosts, can send the triggering traffic and force the target process into a hang or crash loop.
No public proof-of-concept exploit is available. Describing exploitation in prose only: the attacker establishes a TCP connection to a Coherence listener, submits protocol traffic that the Core component fails to process safely, and observes the service becoming unresponsive or terminating.
Detection Methods for CVE-2026-60301
Indicators of Compromise
- Repeated abnormal termination or unresponsive states of Coherence JVM processes without a corresponding administrative action.
- Unexpected TCP connections to Coherence cluster ports from hosts outside the documented cluster membership.
- Application-side errors indicating cache lookup timeouts, cluster member departures, or partition rebalancing loops.
Detection Strategies
- Correlate Coherence log entries reporting member eviction or TcmpException with inbound TCP flow records to identify the source of malformed traffic.
- Alert on Coherence process restarts occurring more frequently than a baseline threshold, especially across multiple cluster members in a short window.
- Monitor JVM crash dumps and hs_err_pid files on Coherence hosts for recurrence patterns tied to the Core component.
Monitoring Recommendations
- Ingest Coherence and JVM logs into a centralized analytics platform and build dashboards for cluster member stability.
- Track Coherence health metrics such as service uptime, request latency, and cluster size for sudden deviations.
- Capture NetFlow or packet metadata on cluster ports so unauthorized TCP sources can be traced after an outage event.
How to Mitigate CVE-2026-60301
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to every Coherence installation running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
- Inventory all Coherence deployments, including embedded uses within other Fusion Middleware products, to ensure none are missed.
- Restrict Coherence cluster ports to trusted cluster members and administrative hosts using host-based and network firewalls.
Patch Information
Oracle addressed CVE-2026-60301 in the July 2026 Critical Patch Update. Patch details, affected component matrices, and download links are available in the Oracle Security Alert: July 2026. Apply patches in a staged manner across cluster members to preserve grid availability during rollout.
Workarounds
- Place Coherence cluster traffic on a dedicated, isolated network segment unreachable from user or internet-facing zones.
- Enforce strict allow-lists on TCP ports used by Coherence Well Known Addresses (WKA) and TCMP listeners.
- Enable Coherence transport authentication and TLS where supported to raise the barrier for unauthenticated network access until patches are deployed.
# Example: restrict Coherence cluster ports to trusted subnets with iptables
iptables -A INPUT -p tcp --dport 7574 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
