Oracle Coherence CVE-2026-60213

Exploitation requires network-level access to Oracle Coherence's HTTP-facing Core component on one of the three affected versions (14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). No authentication is required (CVSS PR:N confirmed). The primary limiting factor is high attack complexity (CVSS AC:H): Oracle explicitly characterizes this as 'difficult to exploit,' meaning the attacker must meet specific, non-trivial conditions - likely precise request sequencing, protocol state manipulation, or timing-dependent triggering - that are not achievable with a single generic request. Exploitation is further limited to environments where Coherence HTTP endpoints are reachable from untrusted networks; deployments that restrict Coherence access to internal application tiers behind a firewall significantly reduce exposure. The data integrity impact (I:L) is constrained to data accessible to the Coherence instance and does not extend to arbitrary backend data stores.

The CVSS 3.1 base score of 6.5 (Medium) reflects a meaningful but bounded risk profile. The AV:N vector confirms the flaw is reachable over the network without physical proximity, and PR:N confirms no authentication is required - both factors that increase potential attacker reach. However, AC:H (High Complexity) is the dominant risk-reducing signal: Oracle explicitly labels this 'difficult to exploit,' implying the attack requires specific timing, precise protocol state, or environmental conditions beyond simple request crafting. The A:H sub-score indicates a full availability loss (hang or repeatable crash) is achievable, which is operationally severe for in-memory data grids that serve as session or caching tiers in production applications. The I:L sub-score indicates limited, not total, data integrity exposure - attackers may be able to corrupt or inject some data records but cannot rewrite arbitrary datasets. No EPSS data was provided in the input, so exploitation probability cannot be quantified numerically. The absence of KEV listing and POC code lowers immediate operational urgency compared to a KEV-confirmed flaw, but the unauthenticated network vector means any exposed Coherence HTTP endpoint is a potential target once a reliable technique is developed. Overall: real but moderate priority - patch within standard patching cycles unless Coherence endpoints are internet-exposed, in which case accelerate.

An unauthenticated attacker with network access to the Coherence HTTP endpoint crafts a specially structured HTTP request that satisfies the high-complexity triggering conditions - likely a specific sequence or timing of requests - causing the Core component to enter an unrecoverable hang state or crash repeatedly, taking down the caching or session tier for dependent applications. In environments where Coherence backs critical application state, this results in cascading failures across the application layer. No public exploit code exists at time of analysis, so reliable exploitation requires independent technique development.