Oracle Coherence CVE-2026-60224

No special conditions - remote unauthenticated exploitation against network-reachable Oracle Coherence, requiring only TCP access to a Coherence cluster or Coherence*Extend proxy port (per AV:N/AC:L/PR:N/UI:N and Oracle's 'easily exploitable, unauthenticated' wording). The practical limiting factor is network reachability: exploitation requires the attacker to reach the Coherence TCP listener, so deployments that keep cluster/Extend ports on isolated internal segments and off internet-facing interfaces materially raise the bar. Affected only on Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; other or already-patched versions are out of scope.

All available signals point to genuine high priority rather than an inflated CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates network reachability, low complexity, no privileges and no user interaction, with full compromise of all three security properties, and Oracle explicitly labels it 'easily exploitable' resulting in 'takeover.' No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so real-world exploitation likelihood cannot be quantified from the input - absence of these signals is not evidence of low risk. The Tags list 'Information Disclosure,' which understates the impact given the CVSS I:H/A:H and Oracle's 'takeover' language; treat the CVSS/Oracle text as authoritative over the tag. Given the trivial exploitation profile of an unauthenticated network takeover, defenders should assume weaponization is feasible even though no public exploit is confirmed yet.

An attacker who can reach a Coherence cluster or Coherence*Extend proxy TCP port sends a crafted request that requires no authentication and no user interaction, triggering the Core-component flaw to gain control of the Coherence process. From that foothold the attacker reads or tampers with cached grid data and can pivot into the WebLogic/Fusion Middleware application tier. No public proof-of-concept is identified at time of analysis, but the low-complexity, unauthenticated profile makes reliable exploitation plausible.