This vulnerability (CVE-2026-60277) affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It is a difficult to exploit flaw that allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence, potentially resulting in full takeover of the product. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory is a general Critical Patch Update advisory listing many products and versions but does not explicitly state a patch or fix for this specific vulnerability in Oracle Coherence. The remediation level is not provided, and no direct patch links are included in the source data.

Successful exploitation can lead to complete compromise of Oracle Coherence, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over Oracle Coherence, potentially affecting dependent applications and services relying on it.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance. Oracle strongly recommends applying security patches promptly and staying on actively supported versions. Until a patch is confirmed, restrict network access to Oracle Coherence services to trusted hosts only and monitor for suspicious network activity targeting TCP ports used by Oracle Coherence.