Oracle Coherence CVE-2026-60233

The attacker must possess low-level privileges and TCP network access to the Oracle Coherence 15.1.1.0.0 instance (PR:L, AV:N per CVSS vector). The specific privilege type - whether Coherence cluster membership, an authenticated Extend client session, or another low-privilege credential - is not described in available data. Attack complexity is low (AC:L) and no user interaction is required (UI:N). Unauthenticated network access alone is insufficient; some form of credential or session is required to reach the vulnerable condition. The impact is bounded to partial availability disruption (A:L) within the Coherence process (S:U), meaning a complete takedown or lateral impact to other systems is not possible through this vulnerability alone.

The CVSS 3.1 Medium score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) reflects a network-exploitable but low-impact vulnerability: attack complexity is low, no user interaction is needed, but low privileges are required, ruling out anonymous exploitation. No EPSS score was provided in available intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified, making opportunistic or widespread exploitation unlikely. The partial availability impact (A:L) limits the real-world consequence to service degradation rather than complete outage. For organizations where Oracle Coherence underpins latency-sensitive or availability-critical workloads, even partial disruption warrants attention; for others, this is a routine patch-cycle item rather than an emergency priority. The absence of a CWE assignment is a data gap that prevents independent assessment of exploitability nuance.

An attacker holding a low-privilege account (for example, a legitimate cluster member or authenticated API user) sends specially crafted TCP requests to the Oracle Coherence Core component on version 15.1.1.0.0. The low attack complexity indicates the trigger is straightforward, requiring no race condition or precise timing. The result is a partial degradation of Coherence availability - such as cache lookup failures or increased latency - affecting dependent applications without a complete service crash.