CVE-2026-60286 is a critical security vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Coherence, potentially resulting in full system takeover. The CVSS 3.1 base score is 9.8, reflecting high severity with impacts on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). Oracle has acknowledged this issue in its July 2026 Critical Patch Update advisory, which bundles multiple security patches across Oracle products. While the advisory confirms the vulnerability's existence and severity, it does not explicitly state the patch status for Oracle Coherence within the provided excerpt. Users are advised to review the official Oracle advisory for detailed patch availability and installation instructions.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access via HTTP to fully compromise Oracle Coherence. This can lead to complete takeover of the affected system, impacting confidentiality, integrity, and availability of the Oracle Coherence service.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory and strongly recommends applying the relevant security patches without delay. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Patch status is not explicitly confirmed in the provided advisory excerpt; therefore, checking the vendor advisory for current remediation guidance is essential.