Oracle Coherence CVE-2026-60232

No special conditions - remote unauthenticated exploitation against default configurations of Oracle Coherence, per Oracle's 'easily exploitable' rating and the CVSS vector AV:N/AC:L/PR:N/UI:N. The only prerequisite is network reachability of a Coherence HTTP-capable endpoint (e.g., an Extend proxy or management/REST listener). Limiting factors are therefore purely architectural: exploitation requires that a Coherence HTTP listener be exposed to the attacker's network position, so deployments where Coherence ports are firewalled to trusted internal hosts, bound to loopback, or isolated on a management network are not remotely reachable. Only the three named versions (14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) are stated as affected.

This is a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) is internally consistent with Oracle's plain-language description of an easily exploitable, unauthenticated, network-based flaw yielding full takeover - the signals do not conflict. No EPSS score, KEV entry, or SSVC decision data was provided, so probabilistic exploitation likelihood cannot be quantified from this input; the absence of a KEV listing means there is no confirmed active exploitation, and no POC was referenced. The primary uncertainty is the root cause: CWE is 'N/A' and the tag 'Information Disclosure' understates the described takeover impact - defenders should treat the full CIA-compromise framing as authoritative. Given Oracle Coherence's typical deployment behind WebLogic/Fusion Middleware in enterprise environments and the trivial exploitation profile, this warrants prompt patching even without KEV confirmation.

An attacker who can reach a Coherence HTTP/Extend listener over the network sends a single crafted request to the Core component and, without any credentials or user interaction, gains full control of the Coherence instance. From that foothold they can read and manipulate cached data across the grid and pivot into the surrounding Fusion Middleware/application tier. No public exploit identified at time of analysis, so exploitation would currently require independent research.