Oracle Coherence CVE-2026-60231

Exploitation requires a valid low-privileged account with network-level HTTP access to the Oracle Coherence Core component - unauthenticated attackers cannot exploit this vulnerability per the CVSS PR:L designation. The 'Authentication Bypass' tag indicates the flaw allows a low-privileged principal to exceed their authorized data access boundary within Coherence (e.g., reading or writing cache partitions not assigned to their role), not that authentication itself is circumvented. The Oracle description explicitly states the attacker must have 'network access via HTTP,' meaning the Coherence HTTP interface must be reachable from the attacker's network position. No special non-default configuration is described as required beyond a standard Coherence deployment with its HTTP interface exposed. Limiting factors include: (1) a valid Coherence credential at any privilege level is mandatory; (2) network connectivity to the HTTP endpoint is required; (3) impact is bounded to data accessible within Oracle Coherence and does not extend to the underlying OS or other Middleware components.

The CVSS 3.1 score of 5.4 (Medium) accurately reflects the constrained impact envelope: exploitation is network-accessible and low-complexity (AV:N/AC:L), but requires a valid low-privileged credential (PR:L), and the blast radius is limited to partial confidentiality and integrity loss with no availability impact (C:L/I:L/A:N/S:U). No EPSS score was provided in the available data, precluding probabilistic exploitation comparison. The vulnerability is not in CISA KEV, and no public PoC is known - exploitation status is 'no public exploit identified at time of analysis.' The 'Authentication Bypass' tag introduces a nuance: the flaw appears to allow low-privileged credentials to exercise access rights beyond their authorized scope, not to bypass authentication entirely, which meaningfully limits opportunistic exploitation to actors who can first obtain valid credentials. Real-world priority is moderate for organizations running Oracle Coherence with network-exposed HTTP endpoints and a broad internal user or service account base; organizations with strict network segmentation and tightly controlled Coherence credentials face lower practical risk. No conflicting signals exist between the CVSS vector and the description, and the vendor-assigned score is consistent with the stated impact bounds.

An attacker holding a low-privileged Coherence account - such as a compromised application service credential or an insider with minimal permissions - sends crafted HTTP requests directly to the Oracle Coherence Core component, exploiting the authorization boundary flaw to access cache regions or data partitions outside their permitted scope. The attacker can read sensitive cached data (application session state, business data, or credentials held in cache) or modify cached records to tamper with application integrity, without needing elevated privileges or triggering user interaction. No public PoC is known, but the low attack complexity (AC:L) means that once credentials are obtained, exploitation does not require specialized tooling.