Oracle Coherence CVE-2026-60237

Exploitation requires TCP network reachability to Oracle Coherence cluster service ports on a system running versions 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no elevated privileges, no special configuration, and no user interaction required - exploitation is viable against default Coherence deployments with externally or internally accessible Core TCP services. The primary limiting factor is network segmentation: Coherence cluster ports are typically not exposed to untrusted networks in well-hardened deployments, meaning the practical attack surface is largely internal or misconfigured perimeter systems. Exploitation is strictly read-only; no write access, code execution, or availability impact is achievable through this vulnerability.

The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) classifies this as Medium severity. The attack vector is fully network-facing with no complexity barrier - the absence of PR:N friction means any host with TCP reachability to Coherence cluster ports can attempt exploitation. However, impact is strictly bounded to partial confidentiality (C:L); integrity and availability are unaffected. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. This CVE is not listed in CISA KEV, and no POC is known at time of analysis. Real-world priority depends heavily on what data Coherence is caching: environments storing sensitive application data, session tokens, or PII in the grid face a meaningfully higher business risk than the moderate CVSS implies. Network segmentation of Coherence cluster ports is the primary mitigating factor that could substantially reduce practical exposure.

An unauthenticated attacker on a network segment with TCP access to an Oracle Coherence cluster port identifies an exposed Core service on a vulnerable version. The attacker sends crafted TCP requests that bypass the authentication enforcement gap in the Core component, receiving in response a subset of data from the in-memory grid - which may include cached application records, session data, or internal state depending on what the application has stored. No POC is publicly known, but the low attack complexity (AC:L) means exploitation does not require specialized tooling or prior reconnaissance beyond port discovery.