This vulnerability in Oracle Coherence's core component allows an unauthenticated attacker with network access via T3 or IIOP protocols to compromise the product. Successful exploitation can lead to full takeover of Oracle Coherence. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle's Critical Patch Update advisory for July 2026 mentions many patches but does not explicitly confirm a patch or remediation level for this CVE. Customers are urged to apply available patches without delay and remain on supported versions.

If exploited, this vulnerability allows an unauthenticated remote attacker to take over Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. This could lead to unauthorized data access, modification, and service disruption. The attack complexity is high, requiring network access via specific protocols (T3, IIOP). No known exploits in the wild have been reported so far.

Oracle's advisory does not explicitly confirm a patch or remediation for CVE-2026-60222 at this time. Customers should monitor the Oracle Critical Patch Update advisory for updates and apply any relevant patches promptly once available. Until a patch is confirmed, restrict network access to Oracle Coherence services via T3 and IIOP protocols to trusted sources only. Follow Oracle's guidance on maintaining supported versions and applying security updates without delay.