CVE-2026-60265 is a vulnerability in the core component of Oracle Coherence within Oracle Fusion Middleware. It affects specific supported versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw allows an attacker with high privileges and logon access to the infrastructure hosting Oracle Coherence to compromise the product, potentially gaining unauthorized access to critical or all data accessible through Oracle Coherence. The vulnerability has a CVSS 3.1 score of 6.0 with vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, indicating local attack vector, low attack complexity, high privileges required, no user interaction, scope change, high confidentiality impact, no integrity or availability impact. The vendor advisory from Oracle references this vulnerability as part of their July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation level for this specific issue. Oracle strongly recommends applying patches from their Critical Patch Update advisories to mitigate such vulnerabilities.

An attacker with high privileges and logon access to the infrastructure where Oracle Coherence executes can exploit this vulnerability to compromise Oracle Coherence. This can result in unauthorized access to critical data or complete access to all data accessible by Oracle Coherence. The vulnerability affects confidentiality but does not impact integrity or availability. The scope of impact may extend beyond Oracle Coherence to additional products due to the interconnected nature of Oracle software.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches without delay as part of their Critical Patch Update process. No specific temporary or official fix is detailed in the advisory for this vulnerability at this time.