This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware, in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It allows an unauthenticated attacker with network access via TCP to compromise the system, contingent on human interaction from a person other than the attacker. The vulnerability can result in unauthorized creation, deletion, or modification of critical data, with a scope change potentially impacting other Oracle products. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality and integrity impacts without availability impact. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among 1449 patches but does not explicitly confirm patch availability or remediation level for this specific issue. No known exploits in the wild have been reported as of the advisory date.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Coherence, compromising confidentiality and integrity. The vulnerability's scope change means it may affect additional Oracle products beyond Coherence. The CVSS score of 9.3 indicates a critical severity with significant impact on data confidentiality and integrity, though availability is not affected. Attackers do not require authentication but do require network access and user interaction from a third party.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses this vulnerability among many others. However, the advisory does not explicitly confirm patch availability or remediation level for CVE-2026-60220 specifically. Users should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply relevant patches promptly. Until patches are applied, organizations should be aware that exploitation requires user interaction and network access via TCP. No vendor statement indicates that no action is required or that the issue is already mitigated.