CVE-2026-60303 Overview
CVE-2026-60303 is a network-exploitable vulnerability in the Core component of Oracle Coherence, part of the Oracle Fusion Middleware suite. A low-privileged attacker with HTTP network access can trigger a partial denial of service condition against affected Coherence deployments. The flaw does not affect confidentiality or integrity, but it can degrade availability of the in-memory data grid. Oracle addressed the issue in the July 2026 Critical Patch Update. Affected supported releases include Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Critical Impact
Authenticated attackers can degrade the availability of Oracle Coherence over HTTP, causing partial denial of service against clustered middleware services.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60303 published to NVD following the Oracle July 2026 Critical Patch Update
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60303
Vulnerability Analysis
The vulnerability resides in the Core component of Oracle Coherence, the distributed in-memory data grid within Oracle Fusion Middleware. An attacker with valid low-privilege credentials can send crafted HTTP requests to a Coherence endpoint and disrupt normal service operation. Successful exploitation results in a partial denial of service, meaning the service remains reachable but experiences degraded performance or interruption of specific functions.
The issue impacts availability only. Confidentiality and integrity are not affected, and the scope remains unchanged, which limits blast radius to the vulnerable Coherence process itself. Because Coherence often backs latency-sensitive workloads such as caching tiers and session stores, even partial availability loss can cascade into upstream application timeouts.
The EPSS probability at publication is 0.279% (percentile 20.06), indicating low near-term exploitation likelihood. No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
Oracle does not publicly disclose root-cause detail for Critical Patch Update issues. Based on the CVSS metrics and component description, the flaw is triggered through the HTTP-facing interface of the Coherence Core and consumes or mishandles server-side resources when processing attacker-controlled input. Refer to the Oracle Security Alert July 2026 for vendor-provided remediation details.
Attack Vector
Exploitation requires network access over HTTP and a low-privileged authenticated session against Oracle Coherence. No user interaction is required. Attack complexity is low, so a single crafted HTTP request or repeated request pattern is sufficient to reproduce the availability impact against an exposed management or application endpoint.
No verified exploit code is available. Refer to the Oracle Security Alert July 2026 for authoritative technical guidance.
Detection Methods for CVE-2026-60303
Indicators of Compromise
- Unexpected spikes in HTTP request volume or error rates against Coherence management and REST endpoints from authenticated low-privilege accounts.
- Sudden increases in Coherence node CPU, thread, or heap consumption without a corresponding workload change.
- Repeated timeouts or partial failures reported by client applications backed by Coherence caches.
Detection Strategies
- Baseline HTTP traffic patterns to Coherence endpoints and alert on deviations in request rate, payload size, and response latency.
- Correlate authentication logs with Coherence service health metrics to identify low-privilege sessions preceding availability degradation.
- Track Oracle Fusion Middleware version inventory to identify hosts still running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 without the July 2026 CPU applied.
Monitoring Recommendations
- Forward Coherence, WebLogic, and reverse-proxy access logs to a central analytics platform for correlation.
- Enable JMX and health-check metric collection on Coherence cluster members to detect partial DoS conditions early.
- Alert on repeated 5xx responses or thread-pool saturation events tied to specific authenticated principals.
How to Mitigate CVE-2026-60303
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle Coherence instances running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
- Inventory all Fusion Middleware deployments and confirm which nodes expose Coherence HTTP endpoints to internal or external networks.
- Review and rotate credentials for low-privilege accounts that can reach Coherence HTTP interfaces.
Patch Information
Oracle addressed CVE-2026-60303 in the July 2026 Critical Patch Update. Administrators should download and apply the fixes listed in the Oracle Security Alert July 2026 advisory for each affected Coherence release. Restart affected cluster members after patching and verify version strings before returning the nodes to production.
Workarounds
- Restrict network reachability of Coherence HTTP endpoints to trusted management subnets using firewall or reverse-proxy access control lists.
- Enforce least privilege on Coherence accounts and disable unused HTTP-exposed management features until patches are deployed.
- Apply rate limiting on the upstream proxy in front of Coherence to reduce the effectiveness of repeated abusive requests.
# Configuration example: restrict Coherence HTTP endpoint to trusted management subnet
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
