Oracle Coherence CVE-2026-60234

Exploitation requires only TCP network access to an Oracle Coherence Core/cluster service endpoint on an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and no special non-default configuration stated as required. The primary limiting factor is network exposure: Coherence is typically deployed on internal application tiers, so realistic exploitation depends on the attacker being able to reach the Coherence TCP listener (cluster port or Coherence*Extend proxy), which segmentation or firewalling would prevent. No platform-specific or feature-toggle prerequisite is documented in the available data.

All available severity signals point the same direction: the CVSS 3.1 vector (AV:N, AC:L, PR:N, UI:N) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, and the C:H/I:H/A:H impacts yield a 9.8 Critical score with Oracle explicitly stating the result is 'takeover of Oracle Coherence.' No EPSS score, SSVC decision, POC, or KEV entry was provided in the input, so exploitation probability cannot be quantified and there is no confirmation of active exploitation - the risk assessment therefore rests on the vector and Oracle's own 'easily exploitable' characterization rather than observed exploitation. One inconsistency to verify: the vendor tags list 'Information Disclosure' while the CVSS impact and description indicate full takeover including integrity and availability loss - the CVSS/description should be treated as authoritative over the tag. Given Coherence's typical deployment on internal/backend tiers, real-world exposure depends heavily on whether Coherence TCP ports are network-reachable to the attacker; where reachable, this is a genuine top-priority issue, not a high-score-but-low-real-risk finding.

An attacker with TCP reachability to a Coherence cluster or proxy port sends a crafted request to the exposed Core service and, without any credentials or user interaction, gains full control over the Coherence instance and its cached data. Because the attack is network-based and low-complexity, an adversary who has gained a foothold on an internal network segment or who reaches an inadvertently exposed proxy port could achieve takeover directly. No public proof-of-concept is identified at time of analysis.