CVE-2026-60267 is a vulnerability in Oracle Coherence (Oracle Fusion Middleware Core component) that permits an unauthenticated attacker with network access over TLS to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Coherence. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality and integrity impacts without affecting availability. The vendor advisory is a general Critical Patch Update (CPU) advisory for July 2026, listing many products and versions but does not explicitly confirm a patch or fix for this specific vulnerability in Oracle Coherence.

An attacker with network access via TLS can exploit this vulnerability without authentication, leading to unauthorized creation, deletion, or modification of critical data within Oracle Coherence. This compromises confidentiality and integrity of data, potentially exposing or altering sensitive information. Availability is not impacted according to the CVSS vector. No known exploits in the wild have been reported at this time.

The vendor advisory references the July 2026 Critical Patch Update, which includes numerous security patches across Oracle products. However, it does not explicitly confirm the availability of a patch or fix for CVE-2026-60267 in Oracle Coherence. Therefore, patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed, consider restricting network access to Oracle Coherence services to trusted hosts and monitoring for unusual activity.