This vulnerability in Oracle Coherence (component: Core) allows an unauthenticated attacker with network access via TCP to compromise the product. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires no privileges or user interaction and can be performed remotely with low complexity, resulting in high confidentiality, integrity, and availability impacts. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a fix for this vulnerability. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function).

Successful exploitation allows an unauthenticated remote attacker to take over Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. This could lead to unauthorized data access, data manipulation, and service disruption.

Oracle has released a Critical Patch Update advisory in July 2026 covering numerous vulnerabilities. However, the advisory does not explicitly confirm a patch for CVE-2026-60274. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions.