Oracle Coherence CVE-2026-60220

Exploitation requires network access to Oracle Coherence over TCP and, critically, human interaction from a person other than the attacker (CVSS UI:R) - for example a legitimate user or operator being lured into triggering the malicious action; without that interaction the attack does not succeed, which is the primary limiting factor. No authentication is required (PR:N), attack complexity is low (AC:L), and it applies to the supported affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The scope change (S:C) means a successful attack can reach beyond Coherence into additional co-deployed products. Availability is not impacted (A:N); the impact is confidentiality and integrity of Coherence-accessible data.

The signals are mostly aligned toward high priority but with one important limiter. CVSS 3.1 is 9.3 driven by AV:N, AC:L, PR:N (unauthenticated), a scope change (S:C), and High confidentiality and integrity impact - a serious, easily exploitable network flaw. The key discriminator is UI:R: exploitation requires human interaction from a person other than the attacker, so this is not a fully autonomous, wormable network exploit; it needs a victim to be lured into an action. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: treat as high-priority patching (unauthenticated + scope change + High C/I in enterprise middleware), but the user-interaction requirement and absence of exploitation evidence argue this is a patch-in-cycle CVE rather than an emergency zero-day. Note the vendor-tagged 'Authentication Bypass' is not independently corroborated by a CWE.

An attacker with only network TCP access to an Oracle Coherence deployment crafts a malicious request or link and induces a legitimate user or operator to trigger it, requiring no attacker credentials. Because the vulnerability crosses a security scope, the attacker gains unauthorized read and modify access to critical Coherence data and can impact adjacent Fusion Middleware products. No public POC was provided, so this scenario is derived from the CVSS vector rather than an observed exploit.