CVE-2026-60232 is a vulnerability in Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 that allows an unauthenticated attacker with network access via HTTP to compromise the system. The vulnerability is easily exploitable and can result in complete takeover of Oracle Coherence, affecting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on all security properties. Oracle's July 2026 Critical Patch Update advisory mentions multiple security patches but does not explicitly confirm a patch for this specific vulnerability or provide remediation details. Customers are urged to apply patches promptly when available.

Successful exploitation of this vulnerability can lead to full compromise of Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. This could allow attackers to take over the product without authentication, posing a critical risk to affected environments.

Oracle has released a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities including this one. However, the advisory does not explicitly confirm patch availability or provide specific remediation instructions for CVE-2026-60232. Customers should monitor the Oracle advisory for updates and apply security patches promptly once confirmed available. Until then, no official fix or temporary mitigation is confirmed. It is recommended to restrict network access to Oracle Coherence instances to trusted sources as a precautionary measure.