Oracle Coherence CVE-2026-60239

Exploitation requires network access to Oracle Coherence's HTTP interface and a low-privileged account on/against the target (CVSS PR:L, AV:N, AC:L, UI:N) - it is NOT fully unauthenticated, so the attacker must already possess some low-level credential or foothold that can send HTTP requests to Coherence. The affected deployment must be one of the supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0 with the Core component's HTTP endpoint reachable. Limiting factors that reduce real-world risk: the Coherence management/cluster HTTP interface is frequently deployed on internal/segmented networks rather than internet-facing, and a valid low-privilege account is needed; the scope change (S:C) is what elevates the consequence because impact can extend to additional products beyond Coherence. Availability is not impacted (A:N), so this cannot be used directly for denial-of-service.

The signals converge on genuine high priority: CVSS 3.1 is 9.6 with an easily exploitable network vector (AV:N/AC:L), only low privileges required (PR:L), no user interaction (UI:N), and a scope change (S:C) that Oracle explicitly says may significantly impact additional products. Impact is on confidentiality and integrity (C:H/I:H) but not availability (A:N), so this is a data-exposure and data-tampering issue rather than a denial-of-service. Counterbalancing factors: it is NOT in CISA KEV (no confirmed active exploitation) and no POC is referenced, so there is no evidence of exploitation in the wild yet. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The combination of low complexity, low privilege, and scope change means that once an exploit surfaces this would be attractive for lateral movement - treat as urgent despite the absence of KEV/POC signals.

A low-privileged user who can reach the Oracle Coherence HTTP interface on the network sends a crafted HTTP request that bypasses authorization controls, then reads or modifies arbitrary Coherence-managed data across the cluster. Because of the scope change, the attacker leverages this foothold to affect additional connected products/services beyond Coherence. No public exploit is identified at time of analysis, and no user interaction is required (UI:N), so the attack requires only network access and a low-privilege account.