CVE-2026-60304: Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. in Oracle Corporation Oracle Coherence
CVE-2026-60304 is a vulnerability in Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It allows a low privileged attacker with network access via TCP to cause a hang or repeated crash, resulting in a denial of service (DoS). The vulnerability impacts availability but does not affect confidentiality or integrity. The CVSS 3.1 base score is 6.5, indicating medium severity.
AI Analysis
Technical Summary
This vulnerability affects the Core component of Oracle Coherence in specified versions. An attacker with low privileges and network access via TCP can exploit this flaw to cause the Oracle Coherence service to hang or crash repeatedly, leading to a complete denial of service. The vulnerability does not impact confidentiality or integrity but affects availability. No specific patch or remediation level is provided in the advisory, and no known exploits in the wild have been reported. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability for it.
Potential Impact
Successful exploitation results in unauthorized ability to cause a hang or frequent crashes of Oracle Coherence, leading to a complete denial of service. There is no impact on confidentiality or integrity of data. The availability impact is rated high, reflected in the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Mitigation Recommendations
The vendor advisory does not explicitly confirm the availability of a patch or workaround for this vulnerability. Oracle strongly recommends applying Critical Patch Updates promptly to mitigate known vulnerabilities. Users should monitor the Oracle Critical Patch Update advisory for July 2026 and subsequent updates for patch availability and installation instructions. Until a patch is confirmed, consider limiting network access to Oracle Coherence services to trusted sources to reduce exposure.
CVE-2026-60304: Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. in Oracle Corporation Oracle Coherence
Description
CVE-2026-60304 is a vulnerability in Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It allows a low privileged attacker with network access via TCP to cause a hang or repeated crash, resulting in a denial of service (DoS). The vulnerability impacts availability but does not affect confidentiality or integrity. The CVSS 3.1 base score is 6.5, indicating medium severity.
CVSS v3.1
Score 6.5medium
Affected software
pkg:maven/com.oracle.coherence/coherenceRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the Core component of Oracle Coherence in specified versions. An attacker with low privileges and network access via TCP can exploit this flaw to cause the Oracle Coherence service to hang or crash repeatedly, leading to a complete denial of service. The vulnerability does not impact confidentiality or integrity but affects availability. No specific patch or remediation level is provided in the advisory, and no known exploits in the wild have been reported. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability for it.
Potential Impact
Successful exploitation results in unauthorized ability to cause a hang or frequent crashes of Oracle Coherence, leading to a complete denial of service. There is no impact on confidentiality or integrity of data. The availability impact is rated high, reflected in the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Mitigation Recommendations
The vendor advisory does not explicitly confirm the availability of a patch or workaround for this vulnerability. Oracle strongly recommends applying Critical Patch Updates promptly to mitigate known vulnerabilities. Users should monitor the Oracle Critical Patch Update advisory for July 2026 and subsequent updates for patch availability and installation instructions. Until a patch is confirmed, consider limiting network access to Oracle Coherence services to trusted sources to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:40.529Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fe6e79c2644c7f8cb1981
Added to database: 07/21/2026, 21:38:47 UTC
Last enriched: 07/30/2026, 04:06:59 UTC
Last updated: 09/03/2026, 10:52:10 UTC
Views: 67
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.