This vulnerability in Oracle Coherence allows an unauthenticated attacker with network access via TCP to compromise the system, potentially resulting in complete takeover. It affects multiple supported versions of Oracle Coherence (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). The CVSS 3.1 vector indicates the attack requires no privileges or user interaction and can be exploited remotely with low complexity, impacting confidentiality, integrity, and availability severely (score 9.8). Oracle's July 2026 Critical Patch Update advisory mentions numerous patches across products but does not explicitly confirm a patch for this specific vulnerability in the provided excerpt. No known exploits in the wild are reported at this time.

Successful exploitation can lead to complete compromise of Oracle Coherence, affecting confidentiality, integrity, and availability of the affected system. This could allow attackers to take over the Oracle Coherence service, potentially impacting dependent applications and data.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities including this one. However, the provided advisory content does not explicitly confirm patch availability for CVE-2026-60227. It is strongly recommended to review the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation instructions. Customers should apply relevant patches promptly once confirmed. No alternative mitigations or workarounds are specified in the advisory content.