Oracle Coherence CVE-2026-60214

Exploitation requires the attacker to have access to the physical/logical communication segment where Oracle Coherence executes (CVSS AV:A) and to already hold low-level privileges (PR:L) - it is not exploitable from the open internet or an arbitrary remote host. The affected feature is the Coherence cluster communication channel, and the 'Authentication Bypass' tag indicates the attacker circumvents the trust/authentication controls governing cluster membership. Limiting factors: the attacker must be on the same network segment as the running Coherence node, must possess some existing low privilege, and only versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are in scope; environments that isolate cluster traffic on a dedicated, access-controlled network sharply reduce reachability. No user interaction is required (UI:N).

The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) describes a low-complexity attack requiring only low privileges and no user interaction, but critically it is NOT network-reachable from arbitrary hosts - AV:A limits the attacker to the physical/logical communication segment where Coherence runs, which is a meaningful containment factor in properly segmented environments. The scope change (S:C) and dual high impact on confidentiality and integrity drive the 8.7 score. No EPSS score, KEV listing, or POC data was provided in the intelligence set, so real-world exploitation pressure cannot be quantified; the absence of KEV/POC signals suggests this is not currently mass-exploited. The practical priority is high for organizations running Coherence clusters on shared or flat network segments, and lower where Coherence traffic is isolated on a dedicated, access-controlled cluster network. Note: 'low privileged attacker' plus 'Authentication Bypass' tag is somewhat in tension - verify with Oracle whether any pre-existing foothold/credential on the segment is truly required.

An attacker who has gained a low-privileged foothold on a server or VLAN sharing the Coherence cluster's communication segment sends crafted cluster protocol traffic that bypasses authentication and joins or impersonates a trusted cluster member. From there they read sensitive cached data and modify or delete grid entries, and because of the scope change the impact extends to other products relying on that Coherence instance. No public exploit code was identified at time of analysis, and the adjacent-network requirement means the attacker must already be positioned on the same segment.