Oracle Coherence CVE-2026-60236

The one hard prerequisite is network TCP reachability to an Oracle Coherence Core listener (cluster/TCMP or Extend proxy port) on an affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); no authentication (PR:N) and no user interaction (UI:N) are required. What limits exploitation in practice is network exposure of those ports - in properly segmented tiered architectures the Coherence listeners are only reachable from internal application hosts, sharply narrowing the attacker population, whereas any deployment that exposes Coherence ports to a broad or untrusted network is directly exploitable against default configurations. No special non-default feature toggle is called out in Oracle's description beyond the product being deployed and network-reachable.

All available signals point to genuine high priority rather than an inflated score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network reachability, low complexity, no privileges, and no user interaction, yielding 9.8 - the maximum practical severity for an unscoped flaw. Oracle explicitly characterizes it as 'easily exploitable' resulting in 'takeover,' reinforcing the low-complexity assessment. However, EPSS data was not provided, so probabilistic exploitation likelihood is unknown; there is no POC referenced and it is not in CISA KEV, so this is not confirmed to be under active exploitation. SSVC framing is not supplied, but derived from the vector the technical impact is total and exploitation is likely automatable if the flaw is deserialization-based. Note the Tags list 'Information Disclosure' while the description and vector describe full I and A impact (takeover) - the tag understates the actual impact, so rely on the CVSS vector and 'takeover' language rather than the tag.

An attacker with network reach to a Coherence cluster or Extend proxy TCP port sends a crafted request/object to the exposed Core listener, requiring no credentials and no user interaction. Because the flaw is 'easily exploitable' and yields takeover, a single successful message can lead to arbitrary control over the Coherence process and the data it holds. No public exploit code has been identified at time of analysis, so this scenario is derived from the CVSS vector and Oracle's description rather than an observed POC.