CVE-2026-60288 is a critical security vulnerability in the Oracle Coherence component of Oracle Fusion Middleware. It affects specific versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows an unauthenticated attacker with network access over TCP to compromise Oracle Coherence, potentially resulting in full system takeover. The CVSS 3.1 score of 9.8 reflects high impact on confidentiality, integrity, and availability. Oracle has included fixes for this vulnerability in its July 2026 Critical Patch Update advisory. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Coherence, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via TCP can take over the affected Oracle Coherence instances, which may result in unauthorized data access, manipulation, and service disruption.

Oracle has released security patches for this vulnerability as part of the July 2026 Critical Patch Update. Users of affected Oracle Coherence versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) should apply the official patches promptly. Oracle strongly recommends remaining on actively supported versions and applying security updates without delay. Patch status is confirmed by the vendor advisory: a fix is available. Refer to the Oracle Critical Patch Update July 2026 advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions.