Oracle Coherence CVE-2026-60212

The only prerequisite is network TCP reachability to an affected Oracle Coherence instance (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); per the CVSS vector AV:N/AC:L/PR:N/UI:N there is no authentication, no user interaction, and no special non-default configuration stated as required - no special conditions beyond network access to the Coherence service ports of Oracle Coherence. The practical limiting factor is exposure of the Coherence cluster/Coherence*Extend proxy TCP ports: instances confined to a segmented internal network or firewalled from untrusted hosts are not remotely reachable, which is the primary control constraining real-world exploitation.

All available severity signals align toward high priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N yields 9.8 with High confidentiality, integrity, and availability impact, and Oracle explicitly labels it 'easily exploitable' by an unauthenticated network attacker resulting in complete takeover. The signals that would normally temper urgency are absent rather than reassuring: there is no EPSS score in the provided data, no SSVC decision content, no CISA KEV listing, and no evidence of public exploit code - so exploitation probability cannot be quantified and should be treated as unknown, not low. The tag 'Information Disclosure' is narrower than the full-A/I 'takeover' language in the description; this is a mild inconsistency likely reflecting incomplete tagging, and the CVSS/description takeover framing should govern prioritization. Given a network-reachable, unauthenticated, low-complexity path to full compromise, this is a genuine priority for any reachable Coherence node, not a high-score-but-low-real-risk case.

An attacker who can reach a Coherence cluster or proxy TCP port from the network sends a crafted request to the exposed service and, without any credentials or user interaction, gains full control of the Coherence node to read cached data, alter it, or disrupt the grid. Because Oracle rates it easily exploitable with low attack complexity, reliable exploitation would likely follow quickly once a technique is published, though no public exploit code is identified at time of analysis.