Oracle Coherence CVE-2026-60229

Exploitation requires network TCP reachability to an Oracle Coherence listener (the cluster/TCMP port or a Coherence*Extend proxy port) on an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0). Per CVSS PR:N/UI:N/AC:L and Oracle's 'easily exploitable' rating, no authentication, no user interaction, and no non-default configuration are stated as required beyond having a reachable Coherence endpoint. The primary limiting factor is network exposure: Coherence cluster/proxy ports are frequently confined to internal or management segments, so attackers must first reach that segment; environments that expose these ports across broad or untrusted networks are directly exploitable, while segmented deployments substantially reduce reachable attack surface.

This is a genuine high priority, not a high-CVSS-but-low-real-risk case. The CVSS vector AV:N/AC:L/PR:N/UI:N is maximally favorable to an attacker: network reachable, low complexity, no privileges, no user interaction, with C:H/I:H/A:H yielding a 9.8 and Oracle's own 'easily exploitable' and 'takeover' language. No EPSS score, KEV entry, POC, or SSVC decision data was provided in the input, so probability-of-exploitation and automatability cannot be quantified from the data given - the assessment rests on the CVSS vector and Oracle's advisory language alone. One inconsistency to verify: the Tags label this 'Information Disclosure,' but the description and the C:H/I:H/A:H vector describe full takeover, so the tag understates the impact - treat the description/vector as authoritative. Because Coherence cluster ports are often exposed on internal networks and sometimes at trust boundaries, exposure depends heavily on deployment; internet-facing or flat-network Coherence listeners represent the highest real-world risk.

An attacker who can reach a Coherence cluster or Extend proxy TCP port sends a crafted message to the Core component from an unauthenticated position on the network. With no credentials and low complexity, the payload drives object processing on the target node to achieve full takeover of the Coherence instance, giving control over cached data and code execution in the Coherence JVM. No public exploit is identified at time of analysis, but the unauthenticated, low-complexity profile means a working exploit would be highly reusable once developed.