CVE-2026-60226 is a vulnerability in the Oracle Coherence component of Oracle Fusion Middleware. It is exploitable by an unauthenticated attacker with network access via TCP, allowing complete compromise of Oracle Coherence. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 base score is 9.8, reflecting critical severity with impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state the patch status for this specific issue. The advisory emphasizes the importance of applying patches promptly to mitigate exploitation risks.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access to take over Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. This can lead to full compromise of Oracle Coherence environments running the affected versions.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. While a specific patch for CVE-2026-60226 is not explicitly confirmed in the advisory content provided, Oracle strongly recommends that customers remain on actively-supported versions and apply Critical Patch Updates without delay to mitigate this and other vulnerabilities. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.