This vulnerability in Oracle Coherence's core component allows an unauthenticated attacker with network access via TCP to exploit the system easily. Successful exploitation can result in complete compromise of Oracle Coherence, impacting confidentiality, integrity, and availability. The affected versions explicitly include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network attack vector with low complexity, no privileges or user interaction required, and high impact on all security properties. Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not specifically confirm a patch for this vulnerability or provide remediation details for Oracle Coherence. No known exploits in the wild have been reported as of the advisory date.

An unauthenticated attacker with network access can exploit this vulnerability to take over Oracle Coherence, leading to full compromise of confidentiality, integrity, and availability of the affected system. This could allow unauthorized data access, modification, and disruption of services relying on Oracle Coherence.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities across Oracle products, including Oracle Coherence. However, the advisory content provided does not explicitly confirm the availability of a patch or official fix for CVE-2026-60230. Users should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch or official fix is confirmed, monitor Oracle's advisories closely and apply updates promptly once available. No vendor statement indicates that no action is required or that the issue is already mitigated.