This vulnerability in Oracle Coherence 15.1.1.0.0 allows an unauthenticated attacker with network access via TCP to compromise the product. Exploitation can lead to unauthorized ability to cause a hang or frequent crash (complete denial of service) and unauthorized read and write access (update, insert, delete) to some accessible data. The CVSS 3.1 base score is 8.6, reflecting high impact on availability and significant impact on confidentiality and integrity. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm patch availability for this vulnerability. The vendor strongly recommends applying patches promptly for supported versions.

Successful exploitation can result in complete denial of service of Oracle Coherence, unauthorized reading of some accessible data, and unauthorized modification (update, insert, delete) of some accessible data. This impacts confidentiality, integrity, and availability of the affected system.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses numerous vulnerabilities across Oracle products. Although the advisory does not explicitly confirm a patch for CVE-2026-60235, Oracle recommends customers apply security patches without delay and remain on actively-supported versions. Patch status for this specific vulnerability is not explicitly confirmed; users should consult the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation information.