This vulnerability in Oracle Coherence allows a low privileged attacker with network access via TCP to perform unauthorized actions on critical data, including creation, deletion, modification, and partial unauthorized read access. The vulnerability affects multiple supported versions of Oracle Coherence (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes numerous patches across Oracle products, but the specific patch availability for this vulnerability is not explicitly confirmed in the advisory content provided.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or all accessible data within Oracle Coherence, as well as unauthorized read access to a subset of accessible data. This compromises data integrity and confidentiality but does not affect availability. The vulnerability is exploitable remotely over the network with low complexity and low privileges, increasing the risk of compromise.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities including this one. However, the provided advisory content does not explicitly confirm the availability of a patch specifically for Oracle Coherence versions affected by CVE-2026-60305. Users should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Patch status is not yet confirmed for this specific vulnerability—check the vendor advisory for current remediation guidance.