Executive brief
Oracle Coherence, a data grid solution used for high-speed data processing and application scaling, is vulnerable to a denial-of-service attack. An unauthenticated attacker can remotely send malicious network traffic to cause the system to hang or crash repeatedly. This could lead to significant service outages and prevent applications from accessing critical cached data.
Technical details
A vulnerability in the Core component of Oracle Coherence allows for a remote denial-of-service (DoS) attack. The flaw is easily exploitable by an unauthenticated attacker with network access via TCP. Successful exploitation enables the attacker to cause a frequently repeatable crash or a complete hang of the Oracle Coherence instance, impacting service availability. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Users are advised to refer to the Oracle Critical Patch Update for July 2026 for remediation steps.
Affected products
- Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
Timeline
- 2026-07-21: disclosed: Initial publication of the CVE record.
- 2026-07-21: advisory: Oracle released the July 2026 Critical Patch Update.