This vulnerability affects Oracle Coherence, a component of Oracle Fusion Middleware. It is easily exploitable remotely without authentication over TCP, enabling attackers to compromise the system fully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector with low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The affected versions are exactly 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle’s July 2026 Critical Patch Update advisory mentions multiple security patches but does not explicitly state patch availability or fixes for this specific vulnerability. Customers are strongly advised to apply Oracle Critical Patch Updates promptly to mitigate risks.

Successful exploitation allows an unauthenticated attacker with network access to completely compromise Oracle Coherence, impacting confidentiality, integrity, and availability of the system. This could lead to full system takeover, unauthorized data access, modification, or denial of service.

Oracle’s July 2026 Critical Patch Update advisory recommends applying security patches without delay. Although the advisory does not explicitly confirm a patch for CVE-2026-60298, it is part of the July 2026 CPU which contains numerous security fixes. Users should verify patch availability and apply the latest Critical Patch Update from Oracle immediately. Patch status is not explicitly confirmed in the advisory text; therefore, check Oracle’s official advisory page for the most current remediation guidance.