CVE-2026-60272 is a vulnerability in Oracle Coherence's core component that permits an unauthenticated attacker with network access over HTTP to compromise the system. The vulnerability affects multiple supported versions of Oracle Coherence (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires no privileges or user interaction and can be executed remotely with low complexity, resulting in high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions a broad set of security patches but does not explicitly state patch availability or remediation details for this specific vulnerability within the provided excerpt.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to fully compromise Oracle Coherence, leading to complete takeover of the system. This includes total loss of confidentiality, integrity, and availability of the affected product. Given the critical CVSS score of 9.8, the impact is severe and could disrupt business operations relying on Oracle Coherence.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities including this one. However, the provided advisory content does not explicitly confirm patch availability or remediation status for CVE-2026-60272. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant patches promptly. Until a patch is confirmed and applied, restrict network access to Oracle Coherence instances to trusted sources only to reduce exposure.