CVE-2026-60307: 
Oracle Coherence vulnerability analysis and mitigation

CVE-2026-60307 is a vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core) that allows a low-privileged attacker with network access via HTTP to gain unauthorized read access to a subset of Oracle Coherence accessible data. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability was disclosed on July 21, 2026, as part of Oracle's July 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 4.3 (Medium) (Oracle CPU Jul 2026).

The vulnerability resides in the Core component of Oracle Coherence and is exploitable over HTTP by a low-privileged, authenticated attacker without requiring user interaction. The attack complexity is low and the scope is unchanged, indicating a straightforward exploitation path once network access is established. The vulnerability results in a confidentiality impact only, with no integrity or availability consequences, suggesting an information disclosure flaw (potentially CWE-200 or similar unauthorized data exposure class). No public technical write-ups or proof-of-concept code have been identified at this time (Oracle CPU Jul 2026).

Successful exploitation allows a low-privileged attacker to read a subset of data accessible within Oracle Coherence, resulting in a partial confidentiality breach. There is no impact to data integrity or system availability. The scope of exposed data is limited to what is accessible within the Coherence instance, reducing the risk of broad lateral movement or full data exfiltration (Oracle CPU Jul 2026).

Oracle has addressed CVE-2026-60307 in the July 2026 Critical Patch Update. Affected organizations should apply the relevant patches for Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 as soon as possible. As a temporary measure, Oracle recommends blocking network protocols required by the attack (HTTP access to Coherence) and restricting access to only authorized users, though neither workaround is a permanent fix. Patch availability details can be found in the Fusion Middleware patch documentation linked from the Oracle CPU advisory (Oracle CPU Jul 2026).