Oracle Coherence CVE-2026-60211

The attacker must have access to the physical communication segment attached to the hardware where Oracle Coherence executes (CVSS AV:A / Adjacent), i.e. layer-2 reachability to the Coherence cluster (TCMP) network - this is the explicit prerequisite stated by Oracle and the primary limiting factor. No authentication is required (PR:N), no user interaction (UI:N), and complexity is low (AC:L), so once on that segment exploitation is easy against affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. What limits real-world exploitation: the flaw is NOT remotely reachable across routed networks or the internet - an attacker cannot exploit it without first obtaining a presence (compromised host or physical/VLAN access) on the cluster communication segment, so proper cluster-network segmentation directly blocks the attack.

The signals are moderately strong but not top-tier for widespread mass exploitation. CVSS 3.1 is 8.8 (High) driven by AV:A/AC:L/PR:N/UI:N with C:H/I:H/A:H - trivial exploitation once network-adjacent, no authentication, no user interaction, unchanged scope. The decisive limiter is AV:A (Adjacent, not Network): the attacker must already have a foothold on the physical/broadcast segment carrying Coherence cluster traffic, which sharply narrows realistic attackers to insiders, compromised co-located hosts, or lateral movers rather than internet-based unauthenticated actors. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified; treat the 8.8 as a ceiling and weight it down by the adjacency requirement and absence of any evidence of in-the-wild use. This is a real 'patch on the next maintenance window and verify cluster network segmentation' priority, not a drop-everything internet-facing emergency.

An attacker who has gained a foothold on the same LAN segment as a Coherence cluster - for example a compromised application server or a malicious device on the cluster VLAN - sends crafted cluster-protocol traffic to a Coherence node with no credentials and no user interaction, given the low attack complexity. Because impact is C:H/I:H/A:H, this yields full takeover of the Coherence instance and the data it caches. No public proof-of-concept has been identified at time of analysis.