Oracle Coherence CVE-2026-60217

No special conditions beyond network reachability - remote unauthenticated exploitation over TCP against Oracle Coherence, per AV:N/AC:L/PR:N/UI:N. The one genuine limiting factor is network exposure: the attacker must be able to reach a Coherence Core/cluster/proxy TCP listener, which in many deployments sits on an internal or cluster-private network rather than the public internet, so segmentation materially reduces the reachable attack surface. Exploitation is confined to the affected supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; no authentication, user interaction, or non-default feature toggle is required.

Every provided signal points to top-tier priority. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields the maximum 10.0 base score: network vector, low complexity, no privileges, no user interaction, full confidentiality/integrity/availability loss, and a scope change indicating impact beyond the vulnerable component. No EPSS score, KEV listing, or SSVC decision data was supplied, so exploitation probability and automatability cannot be quantified from the input, and the absence of a KEV entry means active exploitation is not confirmed despite the perfect CVSS score. No public exploit was identified at time of analysis, so raw severity currently outpaces demonstrated in-the-wild activity. This is a genuine high priority rather than an inflated high-CVSS-but-low-real-risk issue, because the barrier to exploitation is minimal for any reachable instance; the primary risk modulator is exposure, since Coherence often runs on internal cluster networks rather than internet-facing interfaces.

An attacker with network reachability to a Coherence cluster or proxy TCP port sends a crafted request to the exposed Core service without any credentials or user interaction, gaining full control of the Coherence process. Leveraging the scope change, the attacker then pivots from the compromised Coherence runtime into co-hosted Fusion Middleware or WebLogic components. No public proof-of-concept has been identified at time of analysis, but the low attack complexity means weaponization would be straightforward once technical details circulate.