CVE-2026-60258 is a vulnerability in the Core component of Oracle Coherence within Oracle Fusion Middleware. It allows an unauthenticated attacker with network access via TCP to compromise the product, potentially resulting in full system takeover. The vulnerability affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 score of 9.8 reflects critical severity with impacts on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its July 2026 Critical Patch Update advisory, which contains numerous security patches across Oracle products. The advisory strongly recommends applying patches without delay to prevent exploitation.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access to take over Oracle Coherence, compromising confidentiality, integrity, and availability of the system. This can lead to complete control over the affected Oracle Coherence instances.

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Users should apply the relevant security patches for Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory: a fix is available. Refer to the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions.