CVE-2026-60301 is a vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. It allows an unauthenticated attacker with network access via TCP to cause a hang or frequent crash, resulting in a complete denial of service. The vulnerability affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 base score is 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating high impact on availability with no impact on confidentiality or integrity. The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption). Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm a patch for this specific vulnerability in Oracle Coherence. Customers are strongly advised to apply security patches promptly when available.

Successful exploitation allows an unauthenticated attacker with network access to cause Oracle Coherence to hang or crash repeatedly, resulting in a complete denial of service. There is no impact on confidentiality or integrity. This can disrupt availability of services relying on Oracle Coherence.

Oracle's July 2026 Critical Patch Update advisory includes numerous security patches and strongly recommends applying patches without delay. However, the advisory does not explicitly confirm the availability of a patch for CVE-2026-60301 in Oracle Coherence. Therefore, patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Until a patch is confirmed and applied, consider limiting network access to Oracle Coherence services to trusted sources to reduce exposure.