CVE-2026-60276 Oracle CVE debrief

Who should care

Organizations using Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 should prioritize patching this vulnerability to prevent potential takeover of their Oracle Coherence instances. Operators, platform administrators, vulnerability management teams, and security teams should be aware of the affected scope and take necessary actions.

Technical summary

CVE-2026-60276 is a critical vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, specifically in the Core component. The vulnerability has a CVSS score of 9.8 and allows unauthenticated attackers with network access via HTTPS to compromise Oracle Coherence, potentially leading to product takeover. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Organizations should prioritize patching to prevent potential takeover of their Oracle Coherence instances. The vulnerability can have significant operational impacts, and operators, platform administrators, vulnerability management teams, and security teams should be aware of the affected scope and take necessary actions. Evidence is limited to CVE and NVD details, and defenders should verify affected scope and apply patches.

Defensive priority

Oracle Coherence vulnerability with critical CVSS score 9.8 allows unauthenticated network attackers to compromise the product, potentially leading to takeover.

Recommended defensive actions

• Review and apply Oracle's security patches for Coherence product versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
• Implement compensating controls such as network segmentation and access restrictions to limit exposure.
• Monitor Oracle Coherence instances for suspicious activity and ensure up-to-date inventory management.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE-2026-60276 record indicates a critical vulnerability in Oracle Coherence with a CVSS score of 9.8. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows unauthenticated attackers with network access via HTTPS to compromise Oracle Coherence, potentially leading to product takeover. Evidence is limited to CVE and NVD details, and defenders should verify affected scope and apply patches.

Official resources