This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware. It is easily exploitable by unauthenticated attackers over the network via TCP, enabling them to compromise Oracle Coherence and potentially take full control. The CVSS 3.1 score of 9.8 reflects critical severity with impacts across confidentiality, integrity, and availability. The affected versions are 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for this vulnerability. Oracle recommends applying security patches without delay to mitigate exploitation risks.

Successful exploitation can lead to complete compromise of Oracle Coherence, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access can exploit this vulnerability, making it highly critical for affected environments.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly. However, the advisory does not explicitly confirm a patch for CVE-2026-60256. Therefore, patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a patch is confirmed and applied, restrict network access to Oracle Coherence instances and monitor for suspicious activity related to this vulnerability.