Oracle Coherence CVE-2026-60225

Exploitation requires network access to an Oracle Coherence instance's HTTP-reachable Core service endpoint; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed against affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The primary limiting factor is exposure rather than privilege: Coherence cluster/Core traffic is frequently deployed on internal or segmented networks, so an attacker must be able to reach the listening HTTP endpoint - internet-facing or flat-network deployments are directly at risk, while installs restricted to a private cluster subnet require the attacker to first gain that network position. No specific non-default feature toggle is named in the advisory as a prerequisite.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes remote, unauthenticated, low-complexity exploitation requiring no user interaction and yielding complete compromise, and Oracle independently characterizes it as 'easily exploitable' - two aligned signals pointing to real exploitability. Countervailing signals reduce immediate urgency somewhat: it is not in CISA KEV (no confirmed active exploitation), no POC or exploit code has been identified, EPSS was not provided, and no SSVC decision data was supplied, so automatability and exploitation-maturity cannot be scored from the input. The main uncertainty is exposure-dependent: Coherence Core traffic is often deployed on internal cluster networks rather than internet-facing, so real-world reachability hinges on whether the HTTP endpoint is exposed. One data conflict must be flagged: the 'Information Disclosure' tag understates the impact versus the description's full 'takeover' and the C/I/A:High vector - do not down-rank based on the tag. Overall: treat as critical for any Coherence deployment reachable by untrusted networks.

An attacker with network reachability to an exposed Oracle Coherence HTTP endpoint sends a single crafted request to the Core service without any credentials or user interaction, exploiting the low-complexity flaw to gain code execution and full control of the Coherence instance. From there they read or tamper with all cached/grid data and pivot into the surrounding Fusion Middleware environment. No public exploit code has been identified at time of analysis, so this scenario is inferred from the CVSS vector (AV:N/AC:L/PR:N/UI:N) and Oracle's 'easily exploitable' rating.