CVE-2026-60289 is an easily exploitable vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Coherence, potentially leading to full system takeover. The CVSS 3.1 base score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among 1449 patches but does not explicitly state the patch version or remediation level in the provided content. Users are advised to review the official Oracle advisory for patch details and apply updates promptly.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access via HTTP to fully compromise Oracle Coherence, resulting in complete takeover of the system. This impacts confidentiality, integrity, and availability of the affected product, making it a critical security risk.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses this vulnerability along with many others. Although the provided advisory content does not specify the exact patch versions or remediation steps for Oracle Coherence, Oracle strongly recommends that customers apply the available security patches without delay. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance.