Oracle Coherence CVE-2026-60222

Exploitation requires network reachability to an Oracle Coherence instance's T3 or IIOP listener; these are Java remoting protocols normally used for internal WebLogic/Coherence cluster and client traffic, so an exposed or insufficiently firewalled listener is the key precondition. No authentication is required (PR:N) and no user interaction is needed (UI:N), but exploitation is rated difficult (AC:H), indicating additional constraints such as a required deserialization gadget chain on the classpath or specific timing/environmental state. Limiting factors that reduce real-world risk: T3/IIOP should not be internet-exposed in a hardened deployment, only supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are named, and the high attack complexity means casual or automated exploitation is unlikely without a purpose-built exploit.

The signals are mixed and should temper urgency. CVSS 8.1 (High) reflects severe impact (C:H/I:H/A:H) and an unauthenticated network vector (AV:N/PR:N/UI:N), but Oracle explicitly rates it 'difficult to exploit' (AC:H), which materially lowers realistic exploitability - an attacker likely needs a specific gadget chain, timing, or environmental precondition to succeed. There is no EPSS score, no POC, and no CISA KEV listing provided, so no evidence of active or imminent mass exploitation exists at this time. No SSVC decision data was supplied. The practical priority driver is exposure: Coherence T3/IIOP ports are meant to be internal cluster traffic and should not be internet-reachable, so environments that have inadvertently exposed these listeners face the real risk, while properly segmented deployments face little immediate threat. This is a patch-during-normal-cycle item for isolated deployments but should be prioritized wherever T3/IIOP is externally or broadly reachable.

An attacker who can reach an exposed Coherence T3 or IIOP port sends a crafted malicious Java object over the remoting channel that, when deserialized by the Core component, leads to full compromise and takeover of the Coherence instance. Because Oracle rates the flaw difficult to exploit, the attacker likely needs a suitable gadget chain present on the classpath and favorable conditions rather than a trivial one-shot payload. No public exploit code has been identified at time of analysis.