This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware, in versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It is an easily exploitable flaw that allows unauthenticated attackers with network access via TCP to compromise the system, potentially resulting in complete takeover of Oracle Coherence. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory is a general Critical Patch Update notice listing many products and versions but does not explicitly state a patch or fix for this specific vulnerability. Customers are strongly encouraged to apply Oracle Critical Patch Updates promptly. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function).

Successful exploitation allows an unauthenticated attacker with network access to fully compromise Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. This can lead to complete takeover of the Oracle Coherence service, potentially affecting dependent applications and data.

Oracle has published a Critical Patch Update advisory that includes multiple security patches across various products. However, the advisory content provided does not explicitly confirm the availability of a patch or fix for CVE-2026-60257 in Oracle Coherence. Customers should monitor the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for updates and apply any relevant patches as soon as they become available. Until a patch is confirmed, restrict network access to Oracle Coherence instances to trusted sources only and follow Oracle's security best practices. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.