CVE-2026-60307 is a vulnerability in the Oracle Coherence product of Oracle Fusion Middleware that permits a low privileged attacker with network access via HTTP to read unauthorized subsets of accessible data. The affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact. The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly confirm a patch or remediation level for this specific vulnerability but strongly encourages customers to apply security patches without delay. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability allows an attacker with low privileges and network access via HTTP to gain unauthorized read access to a subset of data accessible through Oracle Coherence. The impact is limited to confidentiality with no integrity or availability effects. The CVSS score of 4.3 reflects a medium severity due to the limited confidentiality impact and the requirement for low privileges and network access.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches promptly. Until a specific patch is confirmed, monitor Oracle's Critical Patch Updates for availability and apply them as soon as possible to mitigate this vulnerability.