CVE-2026-60215 is a vulnerability in the Core component of Oracle Coherence within Oracle Fusion Middleware. It is exploitable remotely without authentication over TCP, allowing an attacker to compromise the product fully. The vulnerability affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates an attack with network access, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly state a patch or fix for this specific vulnerability in Oracle Coherence. The advisory strongly recommends applying available patches promptly to mitigate risks.

Successful exploitation allows an unauthenticated attacker with network access to take over Oracle Coherence, impacting confidentiality, integrity, and availability of the system. This can lead to full compromise of the affected Oracle Coherence instances, potentially allowing control over data and operations managed by the product.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay. However, the advisory content provided does not explicitly confirm the availability of a patch or fix for CVE-2026-60215 in Oracle Coherence. Users should monitor Oracle's official security alerts and apply patches as soon as they are released. Until a patch is confirmed, restrict network access to Oracle Coherence instances to trusted sources only and consider additional network-level protections to limit exposure.