CVE-2026-60268 is a vulnerability in the Core component of Oracle Coherence within Oracle Fusion Middleware. It allows an attacker with low privileges and network access via TCP to compromise Oracle Coherence, potentially resulting in complete takeover of the product. The vulnerability affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 score is 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle’s July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state patch availability or remediation details for it. The advisory emphasizes the importance of applying patches promptly but does not confirm if this vulnerability is patched in the update.

Successful exploitation of this vulnerability can lead to a full compromise of Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. An attacker with low privileges and network access via TCP could take over the product, potentially allowing unauthorized access, data manipulation, and service disruption.

Oracle’s July 2026 Critical Patch Update advisory recommends applying security patches promptly to address vulnerabilities, including this one. However, the advisory does not explicitly confirm patch availability or remediation status for CVE-2026-60268. Therefore, users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant updates without delay. Until a patch is confirmed and applied, restrict network access to Oracle Coherence instances to trusted sources only to reduce exposure.