CVE-2026-60262 is an easily exploitable vulnerability in Oracle Coherence's core component that allows unauthenticated attackers with network access via TCP to compromise the product. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting critical impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability as part of a large set of security patches but does not explicitly confirm patch availability or remediation level for this specific CVE. The advisory strongly recommends applying patches promptly to mitigate risks. No public exploits are currently known.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Coherence, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via TCP can take over the affected Oracle Coherence instances, potentially leading to unauthorized data access, data manipulation, and service disruption.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among numerous others and strongly recommends that customers apply the provided security patches without delay. Although the advisory does not explicitly confirm patch availability for CVE-2026-60262, the presence of this vulnerability in the Critical Patch Update implies that patches addressing it are included. Customers should review the July 2026 Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches to affected Oracle Coherence versions promptly. No alternative mitigations or workarounds are specified.