Executive brief
Oracle Coherence, a distributed data grid solution used for high-speed data processing and application scaling, is vulnerable to a remote attack. An unauthenticated attacker can send malicious network traffic to the system to cause it to hang or crash repeatedly. This results in a complete denial of service, potentially disrupting business operations and application availability.
Technical details
A vulnerability in the Core component of Oracle Coherence allows an unauthenticated attacker with network access via TCP to compromise the system. The flaw is categorized as easily exploitable and specifically impacts the availability of the service. Successful exploitation enables an attacker to trigger a hang or a frequently repeatable crash, leading to a complete denial of service (DoS). The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Users are advised to refer to the Oracle Critical Patch Update (CPU) for July 2026 for remediation steps.
Affected products
- Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
Timeline
- 2026-07-21: disclosed: Initial publication of CVE-2026-60223
- 2026-07-21: advisory: Oracle July 2026 Critical Patch Update released