CVE-2026-60248 is a vulnerability in Oracle Coherence (Oracle Fusion Middleware Core component) that allows an unauthenticated attacker, who has logon access to the infrastructure hosting Oracle Coherence, to compromise the product. The vulnerability is easily exploitable and can result in complete takeover of Oracle Coherence. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond Coherence. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates that the attack requires local access to the infrastructure but no privileges or user interaction, and it impacts confidentiality, integrity, and availability at a high level. Affected versions explicitly include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle’s July 2026 Critical Patch Update advisory references this vulnerability but does not provide explicit patch or remediation details for it at this time.

Successful exploitation of this vulnerability can lead to complete takeover of Oracle Coherence, compromising confidentiality, integrity, and availability of the affected system. Due to scope change, other Oracle products that depend on or integrate with Oracle Coherence may also be significantly impacted. The vulnerability requires only logon access to the infrastructure, making it easily exploitable by attackers with such access. The CVSS score of 9.3 reflects critical severity with high impact on confidentiality, integrity, and availability.

Oracle has published a Critical Patch Update advisory in July 2026 that includes security patches for multiple products, including Oracle Coherence. However, the advisory does not explicitly confirm patch availability or remediation level for CVE-2026-60248. Customers should monitor the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for updates on patch availability and apply any relevant patches promptly once available. Until a patch is confirmed, restrict logon access to the infrastructure hosting Oracle Coherence to trusted users only and follow Oracle's security recommendations for infrastructure hardening. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.