CVE-2026-60221 is a critical security vulnerability in Oracle Coherence, part of Oracle Fusion Middleware's core component. It affects specific versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows an unauthenticated attacker with network access via TCP to compromise the Oracle Coherence service, potentially resulting in full system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can be conducted remotely with low complexity, causing high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes patches addressing this vulnerability among 1449 security fixes. The advisory strongly recommends applying patches without delay to mitigate risk. No public exploits have been reported so far.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to fully compromise Oracle Coherence, resulting in complete loss of confidentiality, integrity, and availability of the affected system. This could lead to unauthorized data access, modification, and denial of service or takeover of the Oracle Coherence environment.

Oracle has released a Critical Patch Update in July 2026 that includes security patches addressing CVE-2026-60221. Users of affected Oracle Coherence versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) should apply the relevant patches from the July 2026 CPU promptly. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory. No additional mitigations or workarounds are specified in the advisory.