CVE-2026-60302 is a critical security vulnerability in Oracle Coherence, part of Oracle Fusion Middleware's core component. It is exploitable by unauthenticated attackers over the network via TCP, enabling them to compromise Oracle Coherence and potentially take full control of the system. The vulnerability affects specific versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 score of 9.8 reflects severe impacts on confidentiality, integrity, and availability. Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products. While the vendor advisory does not explicitly state the patch availability for this specific CVE, the Critical Patch Update advisory is the authoritative source for remediation information.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Coherence, affecting confidentiality, integrity, and availability of the affected system. An unauthenticated attacker with network access via TCP can exploit this flaw, potentially resulting in full system takeover.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability among others. Users should promptly apply the security patches provided in this update. The vendor advisory strongly recommends remaining on actively supported versions and applying patches without delay. Patch status for this specific vulnerability is managed through the Critical Patch Update advisory; users should consult https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions.