CVE-2026-60211 is a vulnerability in the core component of Oracle Coherence within Oracle Fusion Middleware. It allows an unauthenticated attacker who has access to the physical communication segment connected to the hardware running Oracle Coherence to compromise the system. This can result in complete takeover of Oracle Coherence, affecting confidentiality, integrity, and availability. The vulnerability affects specific versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 score is 8.8, indicating high severity. Oracle’s July 2026 Critical Patch Update advisory mentions multiple patches across products but does not explicitly confirm a patch for this vulnerability in Oracle Coherence. The advisory emphasizes the importance of applying available patches promptly.

Successful exploitation of this vulnerability allows an unauthenticated attacker with physical network access to the communication segment of the hardware running Oracle Coherence to fully compromise the product. This results in a complete takeover, impacting confidentiality, integrity, and availability of Oracle Coherence. The high CVSS score (8.8) reflects the critical nature of the impact.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict physical access to the communication segments attached to Oracle Coherence hardware to mitigate risk.