CVE-2026-60252: High severity Oracle Oracle Coherence vulnerability
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Coherence (Oracle Fusion Middleware) - Coreto a version that resolves this vulnerability.Fixed in 12.2.1.4.0 - Upgrade
Upgrade
Oracle Coherence (Oracle Fusion Middleware) - Coreto a version that resolves this vulnerability.Fixed in 14.1.1.0.0 - Upgrade
Upgrade
Oracle Coherence (Oracle Fusion Middleware) - Coreto a version that resolves this vulnerability.Fixed in 14.1.2.0.0 - Upgrade
Upgrade
Oracle Coherence (Oracle Fusion Middleware) - Coreto a version that resolves this vulnerability.Fixed in 15.1.1.0.0 - Compensating control
Since the vulnerability is exploitable over TCP by unauthenticated attackers (AV:N/PR:N), restrict network access to Oracle Coherence/Core so that only trusted clients can reach the affected TCP services (e.g., via firewall/ACL).
Event History
Frequently Asked Questions
Which Oracle Coherence versions are affected?
The affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Does an attacker need credentials or user interaction to exploit this issue?
No. The vulnerability is described as easily exploitable by an unauthenticated attacker, with no user interaction required.
What network access does an attacker require?
An attacker needs network access to the Oracle Coherence service via TCP. The CVSS vector indicates network-based attack access with low attack complexity.
What is the expected impact of successful exploitation?
Successful exploitation can allow an attacker to cause Oracle Coherence to hang or crash repeatedly, resulting in a complete denial of service. The stated impact is limited to availability; no confidentiality or integrity impact is listed.