This vulnerability in Oracle Coherence allows an unauthenticated attacker with physical access to the communication segment of the hardware running Oracle Coherence to compromise the product. The affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 score is 8.8 with attack vector 'Adjacent', low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability among many others but does not explicitly state patch availability or remediation details for it. The vendor strongly recommends applying security patches promptly for supported versions. No public exploits are currently known.

Successful exploitation allows an unauthenticated attacker with physical access to the communication segment attached to the Oracle Coherence hardware to fully compromise Oracle Coherence. This results in complete loss of confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.8.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm patch availability or remediation status for CVE-2026-60309. Customers are strongly advised to remain on actively supported versions of Oracle Coherence and apply Oracle Critical Patch Updates without delay. Check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is applied, restrict physical access to the communication segments of hardware running Oracle Coherence to trusted personnel only.