Oracle Coherence CVE-2026-60238

Exploitation requires unauthenticated network access to an Oracle Coherence instance over HTTP (confirmed by AV:N/PR:N in the CVSS vector). The AC:H rating indicates that specific, non-default preconditions must be met for exploitation to succeed - such as knowledge of the Coherence cluster HTTP endpoint, specific request structure to trigger the bypass, or environmental factors. The CVE description does not enumerate these precise conditions, so they must be inferred from CVSS rather than confirmed from the description text. No user interaction is required (UI:N). Exploitation is limited to systems where Coherence's HTTP interface (management API, REST API, or equivalent) is reachable from attacker-controlled network segments - deployments where Coherence listeners are bound only to internal loopback or isolated cluster interfaces would not be directly exposed. The impact is bounded to data confidentiality and integrity (C:L/I:L); no availability impact applies (A:N). Scope change means a second system that consumes Coherence data may also be impacted even if only Coherence itself is directly exploited.

The CVSS 3.1 score of 5.4 (Medium) is shaped primarily by AC:H (high attack complexity) and limited C:L/I:L impact, pulling the score down from what an authentication bypass with scope change might otherwise warrant. The AC:H rating implies exploitation requires specific preconditions - such as precise timing, knowledge of cluster topology, or a non-default configuration - which meaningfully reduces the real-world exploitation rate compared to AC:L vulnerabilities. The scope change (S:C) is the most operationally significant signal: successful exploitation does not merely affect Coherence in isolation but can propagate impact to dependent applications sharing the data grid. No EPSS score was provided in the input data, and the vulnerability does not appear in the CISA KEV catalog at time of analysis, suggesting no confirmed active exploitation. There is no public proof-of-concept identified. For environments running Coherence as a shared data tier across multiple applications, the scope change elevates practical risk above what the raw score implies. For organizations where Coherence is deployed on isolated internal segments with no external HTTP exposure, risk is considerably lower. The CVSS does not indicate an availability impact (A:N), so this is primarily a data confidentiality and integrity concern rather than a service disruption risk.

An unauthenticated remote attacker with HTTP access to an Oracle Coherence cluster sends specially crafted HTTP requests that exploit the authentication bypass flaw in the Core component, gaining unauthorized read access to a subset of cached data and the ability to insert, update, or delete records. Because the scope change is confirmed, the attacker can leverage access to Coherence-managed session or application data to pivot into dependent systems - for example, by injecting malicious data into a shared session cache consumed by a co-hosted application. No public proof-of-concept exploit code has been identified at time of analysis, and the AC:H rating indicates that successful exploitation requires non-trivial preconditions such as knowledge of internal cluster addressing or specific timing.