Oracle Coherence CVE-2026-60218

Exploitation requires TCP network reachability to an Oracle Coherence cluster member or proxy listener plus low-privilege access (CVSS PR:L) - the attacker must be able to authenticate or hold an existing low-level foothold, not act as a fully anonymous internet user, so this is not a PR:N unauthenticated flaw. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning once network + low-privilege access exist, exploitation is straightforward against the affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). Limiting factors: the PR:L requirement and the need to reach Coherence's TCP/cluster ports, which are typically internal rather than internet-facing, so network segmentation materially reduces exposure.

This is a genuine priority for organizations running Coherence. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high impact to all three security properties (C:H/I:H/A:H) and Oracle's own characterization of full product takeover. Oracle labels it 'easily exploitable,' which aligns with AC:L. Counterbalancing signals: it is NOT on the CISA KEV list, no POC or exploit code is referenced, and no EPSS score was provided, so there is no evidence of active or widespread exploitation yet - the risk is currently potential rather than demonstrated. The one PR:L requirement means an attacker needs some existing low-level foothold or valid low-privilege access to the cluster, which modestly limits pure-internet drive-by attacks but is trivial in internal or multi-tenant environments. Note a minor tension: the feed tags this 'Information Disclosure,' yet the CVSS and Oracle description describe full I:H/A:H takeover - treat the tag as incomplete and the takeover characterization as authoritative.

An attacker who has obtained low-privileged access to an internal network segment (or a low-level foothold in a multi-tenant environment) opens a TCP connection to a reachable Oracle Coherence cluster member. Using the low-complexity flaw in the Core component, they send crafted traffic that the grid processes, escalating to full compromise and takeover of Coherence with read/write control over cached data and cluster operations. No user interaction is required and, given AC:L, the attack is reliable; no public POC is currently known.