CVE-2026-60285 is a vulnerability in the Core component of Oracle Coherence within Oracle Fusion Middleware. It allows an unauthenticated attacker with network access via TCP to compromise the product, potentially resulting in full system takeover. The vulnerability affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 score is 9.8, reflecting critical severity with impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory lists Oracle Coherence among affected products but does not explicitly state patch availability or remediation details for this CVE. Customers are urged to apply security patches promptly as part of Oracle's general guidance.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Coherence, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via TCP can exploit this flaw to take over the affected Oracle Coherence instances. This could allow unauthorized access, data manipulation, and disruption of services relying on Oracle Coherence.

Oracle's July 2026 Critical Patch Update advisory includes Oracle Coherence in the list of affected products but does not explicitly confirm patch availability or provide a specific fix for CVE-2026-60285. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation information. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Until a specific patch is confirmed, monitor Oracle's advisories for updates.