Oracle Coherence CVE-2026-60219

No special conditions beyond network reachability - remote unauthenticated exploitation over TCP against affected Oracle Coherence versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 (CVSS AV:N/AC:L/PR:N/UI:N). The one concrete prerequisite is network access to a Coherence Core/cluster or Coherence*Extend proxy TCP listener; exploitation is therefore limited primarily by whether those ports are reachable from the attacker. Deployments that isolate Coherence on a segmented back-end network or firewall its ports to trusted hosts materially reduce reachable attack surface, since the vulnerability offers no authentication or interaction barrier of its own.

All available signals point to genuine high priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields a 9.8 base score with network reach, low complexity, no privileges, and no user interaction, and Oracle explicitly calls it 'easily exploitable' with full takeover impact. There is a conflict to flag: Oracle's own tag says 'Information Disclosure,' yet the vector and prose describe complete compromise (C:H/I:H/A:H, 'takeover') - the takeover characterization should govern prioritization, and the tag appears to be a mislabel. Mitigating the urgency, no EPSS score, SSVC decision, POC, or KEV entry is present in the input, so exploitation probability cannot be quantified and there is no evidence of active exploitation yet. Given Coherence's exposure of TCP cluster/proxy services and the unauthenticated network vector, defenders should treat this as an emergency-patch candidate even absent a public exploit, because Oracle CPU disclosures for pre-auth RCE-class Fusion Middleware bugs are commonly reverse-engineered shortly after release.

An attacker with network reach to a Coherence cluster or proxy TCP port sends crafted traffic to the exposed Core service and, without any credentials or user interaction, gains control of the Coherence process and its data. Because the flaw is unauthenticated and low-complexity, a single reachable listener is enough to achieve full takeover; no public exploit is identified at time of analysis, but the low barrier makes weaponization plausible once details circulate.