CVE-2026-60239 is a vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw allows a low privileged attacker with network access via HTTP to compromise Oracle Coherence, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all Oracle Coherence accessible data. The vulnerability has a CVSS 3.1 base score of 9.6 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts without availability impact. The vulnerability may also impact other Oracle products due to scope change. Oracle has published a Critical Patch Update advisory (July 2026) that includes multiple patches across products, recommending customers apply patches without delay. However, no explicit patch or remediation level for this specific vulnerability is detailed in the advisory content provided.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Coherence. It can also result in unauthorized access to critical data or complete access to all data accessible by Oracle Coherence. The vulnerability affects confidentiality and integrity with high severity (CVSS 9.6). There is no impact on availability reported. Due to scope change, additional Oracle products may be significantly impacted by attacks exploiting this vulnerability.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities including this one. Customers are strongly advised to remain on actively-supported versions and apply Oracle security patches without delay. Since no explicit patch or remediation level is stated for CVE-2026-60239 in the advisory content provided, users should consult the official Oracle Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. No vendor advisory states that no action is required or that the vulnerability is already mitigated, so timely patching is recommended.