CVE-2026-60240 is a critical security vulnerability in the Oracle Coherence product of Oracle Fusion Middleware. It allows an unauthenticated attacker with network access via TCP to compromise the affected Oracle Coherence instances. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 base score is 9.8, reflecting high severity with impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly state the availability of a patch or provide a specific remediation level for this CVE. The advisory emphasizes the importance of applying security patches promptly but does not confirm if this vulnerability is already patched. No public exploits have been reported.

Successful exploitation of CVE-2026-60240 can lead to complete takeover of Oracle Coherence, impacting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via TCP can exploit this vulnerability, making it highly critical. There are no known exploits in the wild at this time.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others and strongly recommends applying security patches without delay. However, the advisory does not explicitly confirm the availability of a patch or remediation for CVE-2026-60240. Therefore, patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance and apply any relevant patches as soon as they become available. Until a patch is confirmed, restrict network access to Oracle Coherence instances where possible.