This vulnerability (CVE-2026-60246) in Oracle Coherence allows an unauthenticated attacker with network access via TCP to compromise the product, potentially leading to full takeover. It affects specific versions of Oracle Coherence (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). The CVSS 3.1 vector indicates the attack requires no privileges or user interaction and can be performed remotely with low complexity, resulting in high confidentiality, integrity, and availability impacts. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for Oracle Coherence. Oracle advises customers to remain on supported versions and apply patches promptly. No public exploits are currently known.

Successful exploitation allows an unauthenticated attacker with network access to completely compromise Oracle Coherence, resulting in full system takeover. This impacts confidentiality, integrity, and availability of the affected systems, representing a critical security risk.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Monitor Oracle advisories for updates on patch availability specific to Oracle Coherence.