Oracle Coherence CVE-2026-60243

Exploitation requires a low-privileged attacker - confirmed by CVSS PR:L - with network-layer TCP access to an Oracle Coherence Core endpoint on one of the four affected versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0. Fully unauthenticated, external exploitation is not confirmed; the PR:L designation indicates some degree of system credentials or privileges is required. No special non-default configuration is indicated as necessary beyond running an affected version with the Core component reachable via TCP. Exploitation is limited by the PR:L requirement (eliminates anonymous internet-facing threats) and the need for TCP reachability to cluster ports (typically mitigated by network segmentation in well-hardened environments). No user interaction on the victim side is required once access conditions are met.

The CVSS 3.1 score of 6.5 (Medium) is driven by the network attack vector, low complexity, and high availability impact, moderated downward by the PR:L requirement. EPSS data was not provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. This vulnerability is not listed in the CISA KEV catalog, and no POC has been publicly identified at time of analysis. Despite the Medium CVSS label, real-world risk is meaningful for Oracle Coherence deployments: the attack is automatable (AC:L, UI:N), any low-privileged user with TCP access qualifies as a threat actor, and the impact is complete availability loss (A:H). In clustered production deployments, crashing the Core component can cascade to all applications consuming the data grid, amplifying business impact beyond the single node. The primary limiting factor is PR:L - fully unauthenticated, external opportunistic attackers are not the threat model here; the risk is highest from insider threats or compromised low-privileged accounts with internal network access.

A low-privileged internal user or compromised service account with network reachability to an Oracle Coherence cluster sends specially crafted TCP packets to the Core component, triggering a hang or repeatable crash of the targeted node. In a production environment serving Oracle WebLogic or custom Java applications, this results in cache unavailability and potential cascading service degradation for all dependent applications. No public POC has been identified, but the low attack complexity (AC:L) suggests the trigger condition may not require deep protocol knowledge once the vulnerability mechanics are understood.