CVE-2026-60282 is a vulnerability in the Core component of Oracle Coherence within Oracle Fusion Middleware. It allows an attacker with low privileges and network access via TCP to compromise Oracle Coherence by gaining unauthorized capabilities to update, insert, delete, or read certain accessible data. The vulnerability affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts with no availability impact. Oracle has included this vulnerability in their July 2026 Critical Patch Update advisory but has not explicitly confirmed patch availability or remediation status for this specific issue. Customers are urged to stay current with Oracle patches to mitigate such vulnerabilities.

Successful exploitation of this vulnerability can lead to unauthorized update, insertion, deletion, and reading of some data accessible via Oracle Coherence. This compromises data confidentiality and integrity but does not affect availability. The attacker requires only low privileges and network access via TCP to exploit the vulnerability. There are no known exploits in the wild at this time.

Oracle has included this vulnerability in their July 2026 Critical Patch Update advisory. However, no explicit patch or remediation level is confirmed yet for CVE-2026-60282. Customers should monitor the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for updates and apply security patches promptly once available. Until a patch is applied, restrict network access to Oracle Coherence services to trusted users and networks where possible.