Executive brief
Oracle Coherence, a distributed data grid solution used for high-speed data processing and application scaling, is vulnerable to a remote attack. An unauthenticated attacker can send malicious network traffic to the system to cause it to hang or crash repeatedly. This results in a total loss of availability for the service, potentially disrupting all applications that rely on Coherence for data storage or caching.
Technical details
A vulnerability in the Core component of Oracle Coherence allows for a remote denial-of-service (DoS). The flaw is easily exploitable by an unauthenticated attacker with network access via TCP. By sending specially crafted requests, an attacker can trigger a condition that results in a hang or a frequently repeatable crash of the Coherence service. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Users are advised to refer to the Oracle Critical Patch Update (CPU) for July 2026 for remediation steps.
Affected products
- Oracle Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory