Oracle Coherence CVE-2026-60226

The attacker requires network TCP reachability to an exposed Oracle Coherence service endpoint (cluster/TCMP or Coherence*Extend proxy port) on one of the affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); per AV:N/AC:L/PR:N/UI:N no authentication, no user interaction, and no special non-default configuration are stated as required - Oracle rates it 'easily exploitable.' The primary limiting factor is network exposure: Coherence is normally deployed within internal middleware tiers, so real-world exploitability hinges on whether its TCP ports are reachable by an untrusted network rather than on any credential or configuration prerequisite. Exploitation is confined to the listed supported versions.

Every raw signal points to high priority: CVSS 9.8 with AV:N/AC:L/PR:N/UI:N means remote, low-complexity, unauthenticated exploitation with full C/I/A impact, and Oracle explicitly labels it 'easily exploitable' - a combination Oracle CPU consumers should treat as top-tier for internet- or cluster-reachable instances. However, corroborating exploitation signals are absent: there is no EPSS score in the input, no KEV listing, no SSVC decision data, and no public POC, so the practical exploitation likelihood cannot be quantified from the provided data and must be treated as unknown rather than low. The 'Information Disclosure' tag is narrower than the description's 'takeover' and the C:H/I:H/A:H vector - treat the tag as incomplete metadata and rely on the full vector, which indicates far more than disclosure. Net: high severity is confirmed by vendor and CVSS; real-world exploitation velocity is unverified. Because Coherence is typically deployed inside application/middleware tiers rather than directly internet-facing, actual exposure depends heavily on whether cluster/Extend TCP ports are reachable by untrusted networks.

An attacker who can reach a Coherence cluster or Extend proxy TCP port from an untrusted network segment sends a crafted request to the exposed service and, without any credentials or user interaction, gains full control of the Coherence instance (data theft, tampering, and disruption). No public POC is identified at time of analysis, but the low attack complexity and lack of authentication (AC:L/PR:N) mean weaponization would be straightforward once exploit details surface.