Oracle Coherence CVE-2026-60215

The attacker only needs TCP network reachability to a Coherence Core listener (cluster TCMP port or a Coherence*Extend proxy port) on an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0) - no credentials, no user interaction, and no special non-default feature toggle are stated by Oracle, which describes it as 'easily exploitable' by an 'unauthenticated attacker with network access via TCP.' The primary limiting factor is network exposure: Coherence ports are typically bound to internal cluster segments, so exploitation requires the attacker to reach that segment, and deployments that firewall listeners to trusted members or enable *Extend TLS/authentication materially reduce reachability. In effect: no special software configuration is required beyond a reachable listener, but the realistic blast radius is gated by where the cluster ports are exposed.

Every automated signal points to high real-world risk: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N gives network reach, low complexity, no privileges, and no user interaction, with H/H/H impacts yielding 9.8. Oracle explicitly describes it as 'easily exploitable' and resulting in full 'takeover,' which is consistent with the vector rather than in conflict with it. However, no EPSS score, SSVC decision, POC, or KEV entry was provided in the input, so exploitation is currently theoretical from a public-evidence standpoint - the priority is driven by exploitability and impact, not by observed attacks. The main tempering factor is exposure: Coherence cluster ports are frequently deployed on internal/trusted network segments, so internet-facing exposure (and thus mass exploitation potential) depends on network placement. Note the 'Information Disclosure' tag is narrower than the C:H/I:H/A:H impact and Oracle's 'takeover' language - treat the vendor CVSS/description as authoritative over the tag.

An attacker with network access to a Coherence cluster or *Extend proxy port sends a crafted TCP message to the Core listener without any credentials, triggering the flaw and gaining code execution or full control of the Coherence node. Because AC:L and PR:N/UI:N apply, no user interaction or authentication is needed, so a single reachable port on an exposed cluster is sufficient. No public exploit identified at time of analysis, so an attacker would need to develop the exploit from the patch or protocol analysis.