Oracle Coherence CVE-2026-60216

No special conditions beyond network reachability - remote unauthenticated exploitation over TCP against Oracle Coherence (Core component) as described by AV:N/AC:L/PR:N/UI:N. The concrete prerequisite is TCP network access to a Coherence cluster or Coherence*Extend proxy listener; the practical limiting factor is that these listener ports are typically deployed on internal/back-end networks rather than Internet-facing, so realistic risk hinges on whether the Coherence TCP ports are reachable from the attacker's position. Only the listed supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) are stated as affected.

The signals are strongly and consistently high-risk: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) indicates remote, low-complexity, unauthenticated exploitation with no user interaction and full CIA impact, and Oracle explicitly labels it 'easily exploitable' resulting in 'takeover.' This is a genuine priority, not a high-CVSS-but-low-real-risk issue. However, some signals are simply absent rather than reassuring: no EPSS score was provided, there is no SSVC decision record, the CVE is not in CISA KEV, and no public POC has been identified - so active-exploitation and automatability cannot be confirmed from the input. One minor note: Oracle's own tags label this 'Information Disclosure,' which conflicts with the described full 'takeover' and I:H/A:H impacts; the CVSS vector and 'takeover' wording should be treated as authoritative over the tag. Overall, treat as critical and patch immediately.

An attacker who can reach a Coherence cluster or Coherence*Extend proxy TCP port from the network sends a crafted request to the Core listener and, without any credentials or user interaction, gains code execution or full control over the Coherence instance and its cached data. Because the vector is AV:N/AC:L/PR:N/UI:N, exploitation requires only network reachability and low complexity; no public POC has been identified at time of analysis, but the low bar makes weaponization feasible if reachable.