CVE-2026-60285: Critical severity Oracle Oracle Coherence vulnerability
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Coherence (Oracle Fusion Middleware) - Coreto a version that resolves this vulnerability.Fixed in 12.2.1.4.0 - Upgrade
Upgrade
Oracle Coherence (Oracle Fusion Middleware) - Coreto a version that resolves this vulnerability.Fixed in 14.1.1.0.0 - Upgrade
Upgrade
Oracle Coherence (Oracle Fusion Middleware) - Coreto a version that resolves this vulnerability.Fixed in 14.1.2.0.0 - Upgrade
Upgrade
Oracle Coherence (Oracle Fusion Middleware) - Coreto a version that resolves this vulnerability.Fixed in 15.1.1.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60285?
CVE-2026-60285 has a critical severity score of 9.8.
How do I fix CVE-2026-60285?
To fix CVE-2026-60285, users should apply the latest patches provided by Oracle for affected versions.
What systems are affected by CVE-2026-60285?
CVE-2026-60285 affects Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0.
What type of attack can exploit CVE-2026-60285?
CVE-2026-60285 can be exploited by an unauthenticated attacker with network access via TCP.
What impact does CVE-2026-60285 have on Oracle Coherence?
CVE-2026-60285 allows an attacker to compromise the integrity and availability of the Oracle Coherence product.