CVE-2026-60306 is a vulnerability in Oracle Coherence (Oracle Fusion Middleware Core component) that allows an unauthenticated attacker with network access via TCP to compromise the system. The vulnerability is easily exploitable and can lead to complete takeover of Oracle Coherence. Affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle’s July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm a patch or fix for this specific vulnerability in Oracle Coherence. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access to fully compromise Oracle Coherence, resulting in complete loss of confidentiality, integrity, and availability of the affected system. This can lead to unauthorized data access, data manipulation, service disruption, and full system takeover.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities across Oracle products. However, the advisory does not explicitly confirm the availability of a patch or fix for CVE-2026-60306 in Oracle Coherence. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until an official fix is confirmed and applied, organizations should restrict network access to Oracle Coherence instances to trusted sources only and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.