CVE-2026-60297 is a critical security vulnerability in Oracle Coherence (Oracle Fusion Middleware Core component) that permits an unauthenticated attacker with network access via TCP to compromise the product. The vulnerability affects specific versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Successful exploitation can result in full takeover of Oracle Coherence, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms the ease of exploitation and severe impact. Oracle has addressed this vulnerability in its July 2026 Critical Patch Update, which contains numerous security patches including for Oracle Coherence. The vendor strongly recommends applying these patches without delay to prevent exploitation.

The vulnerability allows an unauthenticated attacker with network access to completely compromise Oracle Coherence, leading to full control over the affected system. This includes total loss of confidentiality, integrity, and availability of Oracle Coherence services. Such a compromise can disrupt critical middleware operations and potentially affect dependent applications and services.

Oracle has released security patches for this vulnerability as part of its July 2026 Critical Patch Update. Users of Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 should apply the relevant patches promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to mitigate this critical risk. Refer to the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions.