This vulnerability affects the Core component of Oracle Coherence within Oracle Fusion Middleware. It allows a low privileged attacker with network access via TCP to compromise Oracle Coherence, potentially leading to full takeover of the product. The vulnerability has a CVSS 3.1 score of 8.5, indicating high impact on confidentiality, integrity, and availability. The scope of impact extends beyond Oracle Coherence to other Oracle products. The vulnerability is considered difficult to exploit due to the required attack complexity. Oracle's July 2026 Critical Patch Update advisory includes numerous patches for multiple products, including Oracle Coherence, but does not explicitly confirm a patch for this specific CVE. Customers are strongly advised to apply security patches promptly and remain on actively supported versions.

Successful exploitation can lead to complete compromise of Oracle Coherence, affecting confidentiality, integrity, and availability of the system. The vulnerability's scope change means that other Oracle products relying on Coherence may also be impacted. The attack requires network access via TCP and low privileges but is difficult to exploit due to high attack complexity.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses numerous vulnerabilities across Oracle products, including Oracle Coherence. Although the advisory does not explicitly confirm a patch for CVE-2026-60295, Oracle strongly recommends applying all relevant security patches without delay and staying on actively supported versions. Users should review the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Patch status for this vulnerability is not explicitly confirmed; therefore, users must verify current remediation guidance from Oracle.