This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware. It is exploitable remotely without authentication over HTTP/2, enabling an attacker to compromise the system fully. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function). The affected versions explicitly stated are 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not specifically confirm a patch for this CVE in the provided excerpt. No known exploits in the wild have been reported as of the data provided.

Successful exploitation allows an unauthenticated attacker with network access via HTTP/2 to fully compromise Oracle Coherence, impacting confidentiality, integrity, and availability. This can lead to complete takeover of the affected system. The vulnerability is critical with a CVSS score of 9.8, reflecting severe potential damage.

Oracle has released a Critical Patch Update in July 2026 addressing multiple vulnerabilities, including those in Oracle Coherence. However, the provided advisory content does not explicitly confirm patch availability for CVE-2026-60280 or the affected versions. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply relevant patches promptly. Until patches are confirmed and applied, restrict network access to Oracle Coherence instances, especially limiting HTTP/2 exposure. Monitor Oracle's advisories for updates on remediation status.