Oracle's July 2026 Critical Patch Update includes CVE-2026-60224, a CVSS 9.8 flaw in Oracle Coherence that lets an unauthenticated attacker fully compromise the product over the network.
What Is It
CVE-2026-60224 is a critical vulnerability in the Core component of Oracle Coherence, part of Oracle Fusion Middleware. According to Oracle's advisory, the flaw is "easily exploitable" and allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful exploitation can result in complete takeover of Oracle Coherence.
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL), with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact to confidentiality, integrity, and availability.
Why It Matters
The combination of no authentication, low attack complexity, and full compromise makes this a high-priority patching target. An attacker needs only network access to a vulnerable Coherence instance to take it over, with total impact across all three CIA pillars. Coherence is commonly deployed as an in-memory data grid underpinning enterprise middleware, so a takeover can cascade into the applications and data that depend on it.
What's Vulnerable
Per the NVD record, the affected supported versions of Oracle Coherence are:
- 12.2.1.4.0
- 14.1.1.0.0
- 14.1.2.0.0
- 15.1.1.0.0
Patch Status
Oracle addressed this vulnerability in its July 2026 Critical Patch Update (cpujul2026). Administrators should apply the fixes from that Critical Patch Update to affected Oracle Coherence deployments. No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation in the provided source material.