CVE-2026-60224 is a vulnerability in the Core component of Oracle Coherence within Oracle Fusion Middleware. It is easily exploitable by unauthenticated attackers over the network via TCP. Successful exploitation can result in full compromise of Oracle Coherence, impacting confidentiality, integrity, and availability. The vulnerability affects specific versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no privileges or user interaction are required, making it highly critical. Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm a patch for this vulnerability in the provided content. Users are strongly advised to consult the official advisory for patch availability and installation instructions.

The vulnerability allows unauthenticated remote attackers to compromise Oracle Coherence completely, resulting in full takeover. This impacts confidentiality, integrity, and availability of the affected system. Given the CVSS score of 9.8, the impact is critical, potentially allowing attackers to execute arbitrary code, disrupt services, or access sensitive data without any authentication.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses numerous vulnerabilities including this one. However, the advisory content provided does not explicitly confirm patch availability or remediation status for Oracle Coherence. Users should promptly review the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant patches without delay. Until patches are applied, restrict network access to Oracle Coherence instances to trusted hosts only to reduce exposure.