This vulnerability in Oracle Coherence's core component allows an unauthenticated attacker with network access via TCP to exploit the system easily. Successful exploitation can lead to full compromise of Oracle Coherence, including takeover of the product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Affected versions explicitly include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The Oracle Critical Patch Update advisory for July 2026 references this vulnerability among many others but does not provide explicit patch or fix details for Oracle Coherence within the excerpt. No known exploits in the wild have been reported at the time of publication.

An unauthenticated attacker with network access via TCP can exploit this vulnerability to fully compromise Oracle Coherence. This includes complete takeover of the product, impacting confidentiality, integrity, and availability of the system. The critical severity and high CVSS score reflect the potential for severe operational and security consequences if exploited.

Oracle has published a Critical Patch Update advisory in July 2026 that includes security patches for multiple vulnerabilities, including this one. However, the advisory content provided does not explicitly confirm the availability of a patch or fix for Oracle Coherence versions affected by CVE-2026-60287. Customers are strongly advised to consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, organizations should consider restricting network access to Oracle Coherence services to trusted sources only to reduce exposure.