This vulnerability (CVE-2026-60259) affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It is an easily exploitable flaw that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Coherence, potentially resulting in full system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can be performed remotely with low complexity, impacting confidentiality, integrity, and availability at a high level. Oracle has acknowledged the vulnerability in its July 2026 Critical Patch Update advisory but has not provided explicit patch or fix details for this vulnerability in the advisory content provided. The vendor strongly recommends applying security patches promptly, though specific patch information for this vulnerability is not confirmed.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. An attacker can gain unauthorized control over Oracle Coherence without authentication, potentially allowing full system takeover.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay. Until a patch is confirmed and applied, restrict network access to Oracle Coherence instances to trusted sources only.