CVE-2026-60298 is a vulnerability in the Core component of Oracle Coherence within Oracle Fusion Middleware. It affects versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence, potentially resulting in full system takeover. The vulnerability is rated critical with a CVSS 3.1 score of 9.8, reflecting high severity across confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for this vulnerability. Oracle strongly recommends applying all relevant patches from the Critical Patch Update to mitigate risks.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. An unauthenticated attacker with network access via TCP can exploit this flaw, potentially resulting in full system takeover.

Oracle's July 2026 Critical Patch Update advisory includes numerous security patches and strongly recommends customers apply these patches without delay. Although the advisory does not explicitly confirm a patch for CVE-2026-60298, customers should promptly apply all relevant patches from the Critical Patch Update to mitigate this vulnerability. Patch status is not yet confirmed specifically for this vulnerability—check the vendor advisory for current remediation guidance.