CVE-2026-60276 is a vulnerability in Oracle Coherence's core component that permits an unauthenticated attacker with network access over HTTPS to compromise the system. The vulnerability affects multiple supported versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires no privileges or user interaction and can lead to complete confidentiality, integrity, and availability compromise. Oracle has acknowledged this vulnerability in its July 2026 Critical Patch Update advisory, which contains numerous patches across products, but the advisory does not explicitly state the patch status for this vulnerability. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function).

Successful exploitation of this vulnerability can result in complete takeover of Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. An unauthenticated attacker with network access via HTTPS can exploit this flaw without any user interaction or privileges, making it highly critical.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a specific patch for CVE-2026-60276. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches promptly. Until a specific patch is confirmed, monitor Oracle's advisories for updates. No vendor statement indicates that no action is required or that the issue is already mitigated.