CVE-2026-60212 is a vulnerability in Oracle Coherence's core component that permits an unauthenticated attacker with network access via TCP to compromise the system. The vulnerability affects multiple supported versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It has a CVSS 3.1 score of 9.8, reflecting critical severity with high confidentiality, integrity, and availability impacts. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm the availability of a dedicated patch or remediation level for this specific issue. The advisory strongly recommends applying patches promptly to mitigate risks from known vulnerabilities.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. An unauthenticated attacker with network access via TCP can exploit this flaw, making it highly critical and easily exploitable. This could result in unauthorized control over Oracle Coherence, potentially affecting dependent applications and services.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory, which contains numerous security patches. While the advisory does not explicitly confirm a specific patch for CVE-2026-60212, Oracle strongly recommends that customers apply the latest Critical Patch Update without delay to mitigate this and other vulnerabilities. Users should verify patch availability and installation instructions via the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Patch status is not yet confirmed explicitly for this vulnerability; therefore, checking the vendor advisory for current remediation guidance is essential.