CVE-2026-60304 Overview
CVE-2026-60304 is a denial of service vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. A low-privileged attacker with network access via TCP can exploit this flaw to cause a hang or repeatable crash, resulting in complete unavailability of the Coherence service. The vulnerability affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle addressed the issue in the July 2026 Critical Patch Update.
Critical Impact
Successful exploitation results in a complete denial of service against Oracle Coherence, disrupting distributed caching and in-memory data grid services used by dependent applications.
Affected Products
- Oracle Coherence 12.2.1.4.0
- Oracle Coherence 14.1.1.0.0
- Oracle Coherence 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60304 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60304
Vulnerability Analysis
CVE-2026-60304 resides in the Core component of Oracle Coherence, the in-memory data grid used across Oracle Fusion Middleware deployments. An authenticated attacker holding low-level privileges can send crafted TCP traffic to a Coherence cluster member. The condition triggers either a hang or a frequently repeatable crash of the Coherence process. The vulnerability affects availability only, with no reported impact to confidentiality or integrity.
Coherence typically underpins clustered caching, session management, and distributed compute for downstream applications. Loss of Coherence therefore propagates outages to any service that depends on the grid for state or throughput. The EPSS probability is currently 0.319% at the 24th percentile, and no public exploit code has been observed.
Root Cause
Oracle has not disclosed low-level technical detail beyond classifying the issue as an easily exploitable network-reachable defect in the Core component. The advisory attributes the failure mode to the handling of TCP-delivered input that causes resource exhaustion or an unrecoverable error state inside the Coherence runtime, consistent with a denial of service condition.
Attack Vector
The attack vector is network-based over TCP. An adversary requires an authenticated session with minimal privileges to Coherence, then transmits input that provokes the crash or hang. No user interaction is required, and exploitation does not cross a trust boundary. Environments that expose Coherence cluster ports beyond trusted management networks materially increase exposure. See the Oracle Security Alert July 2026 for the vendor's authoritative description.
No verified proof-of-concept code is available. Refer to the vendor advisory for technical context.
Detection Methods for CVE-2026-60304
Indicators of Compromise
- Unexpected termination or hang of Coherence JVM processes across cluster members, particularly when correlated across nodes within short time windows.
- Repeated TCP connections to Coherence cluster ports from unusual source IPs or low-privileged service accounts.
- Sudden drops in cache hit rates or spikes in cluster rejoin events recorded in Coherence logs.
Detection Strategies
- Monitor Coherence application logs for PartitionEvent, cluster departure messages, and unhandled exceptions preceding process termination.
- Alert on repeated JVM crashes or restarts on hosts running Coherence within a short interval.
- Baseline TCP traffic to Coherence cluster and extend ports, and flag connections from sources outside approved application tiers.
Monitoring Recommendations
- Forward Coherence and JVM logs to a centralized analytics platform and retain them long enough to reconstruct crash sequences.
- Track service availability metrics for applications backed by Coherence to detect downstream impact from grid failures.
- Enable network flow logging on segments hosting Coherence to correlate crashes with inbound TCP activity.
How to Mitigate CVE-2026-60304
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle Coherence installations running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
- Restrict TCP access to Coherence cluster and extend ports so that only authorized application and administrative hosts can connect.
- Audit Coherence accounts and remove or rotate credentials for low-privileged users that no longer require access.
Patch Information
Oracle released fixes for CVE-2026-60304 in the July 2026 Critical Patch Update. Administrators should review the Oracle Security Alert July 2026 for patch numbers, prerequisite bundles, and version-specific guidance, then apply the update following standard change control for Fusion Middleware environments.
Workarounds
- Enforce network segmentation so Coherence cluster ports are reachable only from trusted application servers and management jump hosts.
- Require mutual TLS on Coherence extend and cluster communication where supported to limit access to authenticated peers.
- Implement rate limiting and connection quotas at the network layer to slow abusive TCP traffic while patching is scheduled.
# Example iptables rule restricting Coherence cluster port access
# Replace 10.0.0.0/24 with the trusted application subnet and 7574 with your configured Coherence port
iptables -A INPUT -p tcp --dport 7574 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7574 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
