CVE-2026-60273 is a vulnerability in the core component of Oracle Coherence within Oracle Fusion Middleware. It is exploitable by an unauthenticated attacker with network access over TCP, though it is described as difficult to exploit. Successful exploitation can lead to full compromise of Oracle Coherence, impacting confidentiality, integrity, and availability. The affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability is tracked under CWE-306 (Missing Authentication for Critical Function). Oracle’s July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm a patch for this specific CVE in the provided content. No known exploits in the wild have been reported as of the advisory date.

If successfully exploited, this vulnerability allows an unauthenticated attacker with network access via TCP to take over Oracle Coherence, leading to complete compromise of the product. This includes high impact on confidentiality, integrity, and availability of the affected system. Given the high CVSS score (8.1), the vulnerability poses a significant risk to affected deployments.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory, which contains numerous security patches. However, the specific patch for CVE-2026-60273 is not explicitly confirmed in the advisory content provided. Users should consult the official Oracle Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, no additional vendor-recommended mitigations are specified.