CVE-2026-60209 is a vulnerability in the Core component of Oracle Coherence within Oracle Fusion Middleware. It is easily exploitable by unauthenticated attackers with network access over TCP, allowing them to compromise Oracle Coherence and potentially take full control. The vulnerability affects specific versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm a patch for this vulnerability or provide remediation details specific to Oracle Coherence. No known exploits in the wild are reported at this time.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Coherence, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via TCP can take over the product, potentially leading to unauthorized data access, modification, or denial of service.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities, including this one. However, the advisory content provided does not explicitly confirm the availability of a patch or official fix for Oracle Coherence versions affected by CVE-2026-60209. Customers are strongly advised to monitor the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for updates on patch availability and apply any relevant patches promptly once confirmed. Until a patch is confirmed, restrict network access to Oracle Coherence services to trusted sources only and follow Oracle's security best practices for exposure minimization.