CVE-2026-60296 is an easily exploitable vulnerability in the Core component of Oracle Coherence within Oracle Fusion Middleware. It allows unauthenticated attackers with network access over TCP to compromise the product, potentially resulting in full system takeover. The vulnerability affects specific versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 score of 9.8 reflects critical severity with impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes patches addressing this vulnerability among 1449 other security fixes. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Coherence, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via TCP can take over the affected Oracle Coherence instance, potentially leading to unauthorized data access, data manipulation, and service disruption.

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Customers should promptly apply the relevant security patches for Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 as documented in the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. No alternative mitigations or workarounds are specified by the vendor. Staying current with Oracle's security updates is essential to mitigate this critical vulnerability.